Imported WebKit commit a77350243e054f3460d1137301d8b3faee3d2052 (http://svn.webkit.org/repository/webkit/trunk@125365)

New snapshot with build fixes for latest API changes in Qt and all WK1 Win MSVC fixes upstream

280 files changed, 10041 insertions, 3378 deletions

diff --git a/Source/WebKit/CMakeLists.txt b/Source/WebKit/CMakeLists.txt
index 03797a374..a7983d9f0 100644
--- a/Source/WebKit/CMakeLists.txt
+++ b/Source/WebKit/CMakeLists.txt
@@ -31,6 +31,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/filters"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz"
     "${WEBCORE_DIR}/platform/graphics/harfbuzz/ng"
+    "${WEBCORE_DIR}/platform/graphics/opengl"
     "${WEBCORE_DIR}/platform/graphics/transforms"
     "${WEBCORE_DIR}/platform/network"
     "${WEBCORE_DIR}/platform/sql"
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index 19994d1e6..3c5e06ce2 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,115 @@
+2012-08-10  Joshua Netterfield  <jnetterfield@rim.com>
+
+        [WebGL] Add support for EXT_robustness
+        https://bugs.webkit.org/show_bug.cgi?id=93379
+
+        Reviewed by George Staikos.
+
+        RIM PR# 147510
+        Internally reviewed by Arvid Nilsson.
+
+        * CMakeLists.txt: Build system adaptation.
+
+2012-08-10  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Introduce JavaScriptVariant object.
+        https://bugs.webkit.org/show_bug.cgi?id=93644
+
+        The JavaScriptVariant can be used for functions that return results from
+        JavaScript such as executeJavaScript or functions that take arguments
+        to pass a variable to JavaScript and they want to make sure the type
+        is correct.
+
+        Convert executeJavaScriptFunction() to use this data type as the
+        example, other functions will be converted in the future.
+
+        PR 14929
+
+        Internally reviewed by Joe Mason
+        Reviewed by Adam Treat
+
+        * PlatformBlackBerry.cmake:
+
+2012-08-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [BlackBerry] Fix wrong include path for notifications.
+        https://bugs.webkit.org/show_bug.cgi?id=93714
+
+        Reviewed by Rob Buis.
+
+        * PlatformBlackBerry.cmake: Change path from notifications to Modules/notifications.
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Tie up the scrolling machinery to the graphics tree when applicable for in-region scroll
+        https://bugs.webkit.org/show_bug.cgi?id=93482
+
+        Reviewed by Rob Buis.
+
+        * PlatformBlackBerry.cmake: Build system adaptation.
+
+2012-08-07  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Remove PlatformTouchEventEfl and PlatformTouchPointEfl
+        https://bugs.webkit.org/show_bug.cgi?id=93270
+
+        Reviewed by Eric Seidel.
+
+        * PlatformEfl.cmake: Added ewk_touch_event.cpp
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] InspectorOverlay class duplicated in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=93124
+
+        Reviewed by Rob Buis.
+
+        Updated InspectorOverlay build path.
+
+        * PlatformBlackBerry.cmake:
+
+2012-08-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Make it possible to build without QtQuick
+
+        Reviewed by Simon Hausmann.
+
+        * WebKit1.pri:
+
+2012-07-19  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebKit.pri:
+        * WebKit1.pri:
+        * WebKit1.pro:
+
+2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        CUSTOM_SCHEME_HANDLER flag should depend on REGISTER_PROTOCOL_HANDLER
+        https://bugs.webkit.org/show_bug.cgi?id=93081
+
+        Reviewed by Adam Barth.
+
+        Modified PlatformEfl.cmake so that CUSTOM_SCHEME_HANDLER flag cannot act without REGISTER_PROTOCOL_HANDLER being set.
+
+        * PlatformEfl.cmake:
+
+2012-08-01  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Implement InRegionScroller class as a in-region scroll controller
+        https://bugs.webkit.org/show_bug.cgi?id=92889
+        PR #186587
+
+        Reviewed by Yong Li.
+
+        Internally reviewed by Arvid Nilsson.
+
+        * PlatformBlackBerry.cmake: Added InRegionScroller.cpp|h to the build system.
+
 2012-07-30  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Unreviewed Qt/Mac build fix: Use libWebKitSystemInterfaceMountainLion.a
diff --git a/Source/WebKit/PlatformBlackBerry.cmake b/Source/WebKit/PlatformBlackBerry.cmake
index 05aaed8a9..d133d0fa9 100644
--- a/Source/WebKit/PlatformBlackBerry.cmake
+++ b/Source/WebKit/PlatformBlackBerry.cmake
@@ -10,15 +10,15 @@ LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/html/canvas"
     "${WEBCORE_DIR}/html/parser" # For HTMLParserIdioms.h
     "${WEBCORE_DIR}/loader/appcache"
-    "${WEBCORE_DIR}/notifications"
     "${WEBCORE_DIR}/platform/blackberry"
     "${WEBCORE_DIR}/platform/graphics/blackberry"
     "${WEBCORE_DIR}/platform/graphics/blackberry/skia"
     "${WEBCORE_DIR}/platform/graphics/skia"
     "${WEBCORE_DIR}/platform/network/blackberry"
-    "${WEBCORE_DIR}/Modules/websockets"
     "${WEBCORE_DIR}/Modules/geolocation"
+    "${WEBCORE_DIR}/Modules/notifications"
     "${WEBCORE_DIR}/Modules/vibration"
+    "${WEBCORE_DIR}/Modules/websockets"
     "${WEBKIT_DIR}/blackberry/Api"
     "${WEBKIT_DIR}/blackberry/WebCoreSupport"
     "${WEBKIT_DIR}/blackberry/WebKitSupport"
@@ -57,6 +57,7 @@ ADD_DEFINITIONS(-DUSER_PROCESSES)
 LIST(APPEND WebKit_SOURCES
     blackberry/Api/BackingStore.cpp
     blackberry/Api/BlackBerryGlobal.cpp
+    blackberry/Api/InRegionScroller.cpp
     blackberry/Api/WebAnimation.cpp
     blackberry/Api/WebKitMIMETypeConverter.cpp
     blackberry/Api/WebKitTextCodec.cpp
@@ -68,6 +69,7 @@ LIST(APPEND WebKit_SOURCES
     blackberry/Api/WebSettings.cpp
     blackberry/Api/WebString.cpp
     blackberry/Api/WebViewportArguments.cpp
+    blackberry/Api/JavaScriptVariant.cpp
     blackberry/WebCoreSupport/AutofillManager.cpp
     blackberry/WebCoreSupport/CacheClientBlackBerry.cpp
     blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -84,7 +86,6 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebCoreSupport/GeolocationControllerClientBlackBerry.cpp
     blackberry/WebCoreSupport/IconDatabaseClientBlackBerry.cpp
     blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
-    blackberry/WebCoreSupport/InspectorOverlay.cpp
     blackberry/WebCoreSupport/JavaScriptDebuggerBlackBerry.cpp
     blackberry/WebCoreSupport/NotificationPresenterImpl.cpp
     blackberry/WebCoreSupport/VibrationClientBlackBerry.cpp
@@ -100,6 +101,8 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebKitSupport/FrameLayers.cpp
     blackberry/WebKitSupport/InPageSearchManager.cpp
     blackberry/WebKitSupport/InputHandler.cpp
+    blackberry/WebKitSupport/InRegionScrollableArea.cpp
+    blackberry/WebKitSupport/InspectorOverlay.cpp
     blackberry/WebKitSupport/RenderQueue.cpp
     blackberry/WebKitSupport/SelectionHandler.cpp
     blackberry/WebKitSupport/SelectionOverlay.cpp
diff --git a/Source/WebKit/PlatformEfl.cmake b/Source/WebKit/PlatformEfl.cmake
index a7005228f..1706cda3a 100644
--- a/Source/WebKit/PlatformEfl.cmake
+++ b/Source/WebKit/PlatformEfl.cmake
@@ -88,7 +88,7 @@ IF (ENABLE_BATTERY_STATUS)
   )
 ENDIF ()
 
-IF (ENABLE_REGISTER_PROTOCOL_HANDLER OR ENABLE_CUSTOM_SCHEME_HANDLER)
+IF (ENABLE_REGISTER_PROTOCOL_HANDLER)
   LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/Modules/protocolhandler"
   )
@@ -136,6 +136,7 @@ LIST(APPEND WebKit_SOURCES
     efl/ewk/ewk_tiled_backing_store.cpp
     efl/ewk/ewk_tiled_matrix.cpp
     efl/ewk/ewk_tiled_model.cpp
+    efl/ewk/ewk_touch_event.cpp
     efl/ewk/ewk_util.cpp
     efl/ewk/ewk_view.cpp
     efl/ewk/ewk_view_single.cpp
diff --git a/Source/WebKit/WebKit.pri b/Source/WebKit/WebKit.pri
index a2d9d4bdf..5a8f4dfe3 100644
--- a/Source/WebKit/WebKit.pri
+++ b/Source/WebKit/WebKit.pri
@@ -37,7 +37,7 @@ HEADERS += \
     $$PWD/qt/Api/qwebplugindatabase_p.h \
     $$PWD/qt/Api/qhttpheader_p.h
 
-haveQt(5): contains(CONFIG, accessibility) {
+contains(CONFIG, accessibility) {
     SOURCES += $$PWD/qt/Api/qwebviewaccessible.cpp
     HEADERS += $$PWD/qt/Api/qwebviewaccessible_p.h
 }
diff --git a/Source/WebKit/WebKit1.pri b/Source/WebKit/WebKit1.pri
index b16d6f130..992fb56a2 100644
--- a/Source/WebKit/WebKit1.pri
+++ b/Source/WebKit/WebKit1.pri
@@ -30,22 +30,17 @@ contains(DEFINES, ENABLE_VIDEO=1):contains(DEFINES, WTF_USE_QTKIT=1) {
 }
 
 contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1)|contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
-    haveQt(5) {
-        QT += sensors
-    } else {
-        CONFIG *= mobility
-        MOBILITY *= sensors
-    }
+    QT += sensors
 }
 
-contains(DEFINES, ENABLE_GEOLOCATION=1):haveQt(5): QT += location
+contains(DEFINES, ENABLE_GEOLOCATION=1): QT += location
 
 contains(CONFIG, texmap): DEFINES += WTF_USE_TEXTURE_MAPPER=1
 
 plugin_backend_xlib: PKGCONFIG += x11
 
-QT += network
-haveQt(5): QT += widgets printsupport quick
+QT += network widgets printsupport
+contains(DEFINES, HAVE_QTQUICK=1): QT += quick
 
 contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1)|contains(DEFINES, ENABLE_WEBGL=1) {
     QT *= opengl
diff --git a/Source/WebKit/WebKit1.pro b/Source/WebKit/WebKit1.pro
index 8b030bfc9..82cd0cd0c 100644
--- a/Source/WebKit/WebKit1.pro
+++ b/Source/WebKit/WebKit1.pro
@@ -94,7 +94,7 @@ HEADERS += \
     $$PWD/qt/WebCoreSupport/PlatformStrategiesQt.h \
     $$PWD/qt/WebCoreSupport/WebEventConversion.h
 
-haveQt(5): contains(QT_CONFIG,accessibility) {
+contains(QT_CONFIG,accessibility) {
     SOURCES += $$PWD/qt/Api/qwebviewaccessible.cpp
     HEADERS += $$PWD/qt/Api/qwebviewaccessible_p.h 
 }
diff --git a/Source/WebKit/blackberry/Api/BackingStore.cpp b/Source/WebKit/blackberry/Api/BackingStore.cpp
index a0fa295e3..878665054 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.cpp
+++ b/Source/WebKit/blackberry/Api/BackingStore.cpp
@@ -209,7 +209,6 @@ BackingStorePrivate::BackingStorePrivate()
     , m_hasBlitJobs(false)
     , m_currentWindowBackBuffer(0)
     , m_preferredTileMatrixDimension(Vertical)
-    , m_blitGeneration(-1)
 #if USE(ACCELERATED_COMPOSITING)
     , m_needsDrawLayersOnCommit(false)
     , m_isDirectRenderingAnimationMessageScheduled(false)
@@ -226,14 +225,6 @@ BackingStorePrivate::BackingStorePrivate()
     pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE);
     pthread_mutex_init(&m_mutex, &attr);
     pthread_mutexattr_destroy(&attr);
-
-    pthread_mutex_init(&m_blitGenerationLock, 0);
-
-    pthread_condattr_t condattr;
-    pthread_condattr_init(&condattr);
-    pthread_condattr_setclock(&condattr, CLOCK_MONOTONIC);
-    pthread_cond_init(&m_blitGenerationCond, &condattr);
-    pthread_condattr_destroy(&condattr);
 }
 
 BackingStorePrivate::~BackingStorePrivate()
@@ -246,8 +237,6 @@ BackingStorePrivate::~BackingStorePrivate()
     delete back;
     m_backState = 0;
 
-    pthread_cond_destroy(&m_blitGenerationCond);
-    pthread_mutex_destroy(&m_blitGenerationLock);
     pthread_mutex_destroy(&m_mutex);
 }
 
@@ -1141,26 +1130,11 @@ bool BackingStorePrivate::render(const Platform::IntRect& rect)
         BlackBerry::Platform::Graphics::Buffer* nativeBuffer
             = tile->backBuffer()->nativeBuffer();
 
-        // This code is only needed for EGLImage code path, and only effective if we are swapping the render target.
-        // This combination is only true if there's a GLES2Usage window.
-        // FIXME: Use an EGL fence instead, PR152132
-        Window* window = m_webPage->client()->window();
-        if (window && window->windowUsage() == Window::GLES2Usage) {
-            pthread_mutex_lock(&m_blitGenerationLock);
-            while (m_blitGeneration == tile->backBuffer()->blitGeneration()) {
-                int err = pthread_cond_timedwait(&m_blitGenerationCond, &m_blitGenerationLock, &m_currentBlitEnd);
-                if (err == ETIMEDOUT) {
-                    ++m_blitGeneration;
-                    break;
-                }
-                if (err) {
-                    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelCritical,
-                                              "cond_timedwait failed (%s)", strerror(err));
-                    break;
-                }
-            }
-            pthread_mutex_unlock(&m_blitGenerationLock);
-        }
+        // TODO: This code is only needed for EGLImage code path, but preferrably BackingStore
+        // should not know that, and the synchronization should be in BlackBerry::Platform::Graphics
+        // if possible.
+        if (isOpenGLCompositing())
+            SurfacePool::globalSurfacePool()->waitForBuffer(tile->backBuffer());
 
         // Modify the buffer only after we've waited for the buffer to become available above.
 
@@ -1433,14 +1407,17 @@ void BackingStorePrivate::blitContents(const Platform::IntRect& dstRect,
             // Blit checkered to those parts that are not covered by the backingStoreRect.
             IntRectList checkeredRects = checkeredRegion.rects();
             for (size_t i = 0; i < checkeredRects.size(); ++i) {
-                Platform::IntRect dstRect = transformation.mapRect(Platform::IntRect(
+                Platform::IntRect clippedDstRect = transformation.mapRect(Platform::IntRect(
                     Platform::IntPoint(checkeredRects.at(i).x() - origin.x(), checkeredRects.at(i).y() - origin.y()),
                                        checkeredRects.at(i).size()));
+                // To eliminate 1 pixel inflation due to transformation rounding.
+                clippedDstRect.intersect(dstRect);
 #if DEBUG_CHECKERBOARD
                 blitCheckered = true;
 #endif
+
                 fillWindow(BlackBerry::Platform::Graphics::CheckerboardPattern,
-                    dstRect, checkeredRects.at(i).location(), transformation.a());
+                    clippedDstRect, checkeredRects.at(i).location(), transformation.a());
             }
         }
 
@@ -1561,6 +1538,12 @@ void BackingStorePrivate::blitContents(const Platform::IntRect& dstRect,
         }
     }
 
+    // TODO: This code is only needed for EGLImage code path, but preferrably BackingStore
+    // should not know that, and the synchronization should be in BlackBerry::Platform::Graphics
+    // if possible.
+    if (isOpenGLCompositing())
+        SurfacePool::globalSurfacePool()->notifyBuffersComposited(blittedTiles);
+
 #if USE(ACCELERATED_COMPOSITING)
     if (WebPageCompositorPrivate* compositor = m_webPage->d->compositor()) {
         WebCore::FloatRect contentsRect = m_webPage->d->mapFromTransformedFloatRect(WebCore::FloatRect(WebCore::IntRect(contents)));
@@ -1628,28 +1611,6 @@ void BackingStorePrivate::blitContents(const Platform::IntRect& dstRect,
 #endif
 
     invalidateWindow(dstRect);
-
-    // This code is only needed for EGLImage code path, and only effective if we are swapping the render target.
-    // This combination is only true if there's a GLES2Usage window.
-    // FIXME: Use an EGL fence instead
-    Window* window = m_webPage->client()->window();
-    if (window && window->windowUsage() == Window::GLES2Usage && !blittedTiles.isEmpty()) {
-        pthread_mutex_lock(&m_blitGenerationLock);
-
-        ++m_blitGeneration;
-        for (unsigned int i = 0; i < blittedTiles.size(); ++i)
-            blittedTiles[i]->setBlitGeneration(m_blitGeneration);
-
-        clock_gettime(CLOCK_MONOTONIC, &m_currentBlitEnd);
-        m_currentBlitEnd.tv_nsec += 30 * 1000 * 1000;
-        if (m_currentBlitEnd.tv_nsec >= 1000000000L) {
-            m_currentBlitEnd.tv_sec  += 1;
-            m_currentBlitEnd.tv_nsec -= 1000000000L;
-        }
-
-        pthread_mutex_unlock(&m_blitGenerationLock);
-        pthread_cond_signal(&m_blitGenerationCond);
-    }
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1669,6 +1630,7 @@ void BackingStorePrivate::compositeContents(WebCore::LayerRenderer* layerRendere
 
     BackingStoreGeometry* currentState = frontState();
     TileMap currentMap = currentState->tileMap();
+    Vector<TileBuffer*> compositedTiles;
 
     Platform::IntRectRegion transformedContentsRegion = transformedContents;
     Platform::IntRectRegion backingStoreRegion = currentState->backingStoreRect();
@@ -1708,7 +1670,7 @@ void BackingStorePrivate::compositeContents(WebCore::LayerRenderer* layerRendere
             layerRenderer->drawCheckerboardPattern(transform, m_webPage->d->mapFromTransformedFloatRect(Platform::FloatRect(dirtyRect)));
         else {
             layerRenderer->compositeBuffer(transform, m_webPage->d->mapFromTransformedFloatRect(Platform::FloatRect(wholeRect)), tileBuffer->nativeBuffer(), contentsOpaque, 1.0f);
-
+            compositedTiles.append(tileBuffer);
             // Intersect the rendered region.
             Platform::IntRectRegion notRenderedRegion = Platform::IntRectRegion::subtractRegions(dirtyTileRect, tileBuffer->renderedRegion());
             IntRectList notRenderedRects = notRenderedRegion.rects();
@@ -1716,6 +1678,8 @@ void BackingStorePrivate::compositeContents(WebCore::LayerRenderer* layerRendere
                 layerRenderer->drawCheckerboardPattern(transform, m_webPage->d->mapFromTransformedFloatRect(Platform::FloatRect(notRenderedRects.at(i))));
         }
     }
+
+    SurfacePool::globalSurfacePool()->notifyBuffersComposited(compositedTiles);
 }
 #endif
 
diff --git a/Source/WebKit/blackberry/Api/BackingStore_p.h b/Source/WebKit/blackberry/Api/BackingStore_p.h
index 67913b986..c29684717 100644
--- a/Source/WebKit/blackberry/Api/BackingStore_p.h
+++ b/Source/WebKit/blackberry/Api/BackingStore_p.h
@@ -369,11 +369,6 @@ public:
 
     pthread_mutex_t m_mutex;
 
-    int m_blitGeneration;
-    pthread_mutex_t m_blitGenerationLock;
-    pthread_cond_t m_blitGenerationCond;
-    struct timespec m_currentBlitEnd;
-
 #if USE(ACCELERATED_COMPOSITING)
     mutable bool m_needsDrawLayersOnCommit; // Not thread safe, WebKit thread only
     bool m_isDirectRenderingAnimationMessageScheduled;
diff --git a/Source/WebKit/blackberry/Api/InRegionScroller.cpp b/Source/WebKit/blackberry/Api/InRegionScroller.cpp
new file mode 100644
index 000000000..09012c1fd
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/InRegionScroller.cpp
@@ -0,0 +1,393 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "InRegionScroller.h"
+
+#include "BackingStoreClient.h"
+#include "Frame.h"
+#include "HTMLFrameOwnerElement.h"
+#include "HitTestResult.h"
+#include "InRegionScrollableArea.h"
+#include "InRegionScroller_p.h"
+#include "LayerCompositingThread.h"
+#include "Page.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+#include "RenderObject.h"
+#include "RenderView.h"
+#include "WebPage_p.h"
+
+using namespace WebCore;
+
+namespace BlackBerry {
+namespace WebKit {
+
+static bool canScrollInnerFrame(Frame*);
+static bool canScrollRenderBox(RenderBox*);
+static RenderLayer* parentLayer(RenderLayer*);
+static Node* enclosingLayerNode(RenderLayer*);
+static bool isNonRenderViewFixedPositionedContainer(RenderLayer*);
+static void pushBackInRegionScrollable(std::vector<Platform::ScrollViewBase*>&, InRegionScrollableArea*, InRegionScrollerPrivate*);
+
+InRegionScroller::InRegionScroller(WebPagePrivate* webPagePrivate)
+    : d(new InRegionScrollerPrivate(webPagePrivate))
+{
+    ASSERT(webPagePrivate);
+}
+
+InRegionScroller::~InRegionScroller()
+{
+    delete d;
+}
+
+bool InRegionScroller::compositedSetScrollPosition(unsigned camouflagedLayer, const Platform::IntPoint& scrollPosition)
+{
+    ASSERT(Platform::userInterfaceThreadMessageClient()->isCurrentThread());
+    return d->compositedSetScrollPosition(camouflagedLayer, d->m_webPage->mapFromTransformed(scrollPosition));
+}
+
+InRegionScrollerPrivate::InRegionScrollerPrivate(WebPagePrivate* webPagePrivate)
+    : m_webPage(webPagePrivate)
+{
+}
+
+void InRegionScrollerPrivate::setNode(WebCore::Node* node)
+{
+    m_inRegionScrollStartingNode = node;
+}
+
+WebCore::Node* InRegionScrollerPrivate::node() const
+{
+    return m_inRegionScrollStartingNode.get();
+}
+
+void InRegionScrollerPrivate::reset()
+{
+    setNode(0);
+}
+
+bool InRegionScrollerPrivate::hasNode() const
+{
+    return !!m_inRegionScrollStartingNode;
+}
+
+bool InRegionScrollerPrivate::canScroll() const
+{
+    return hasNode();
+}
+
+bool InRegionScrollerPrivate::compositedSetScrollPosition(unsigned camouflagedLayer, const WebCore::IntPoint& scrollPosition)
+{
+    LayerCompositingThread* scrollLayer = reinterpret_cast<LayerCompositingThread*>(camouflagedLayer);
+    scrollLayer->override()->setBoundsOrigin(WebCore::FloatPoint(scrollPosition.x(), scrollPosition.y()));
+
+    m_webPage->scheduleCompositingRun();
+    return true;
+}
+
+bool InRegionScrollerPrivate::scrollBy(const Platform::IntSize& delta)
+{
+    ASSERT(Platform::webkitThreadMessageClient()->isCurrentThread());
+
+    if (!canScroll())
+        return false;
+
+    return scrollNodeRecursively(node(), delta);
+}
+
+std::vector<Platform::ScrollViewBase*> InRegionScrollerPrivate::inRegionScrollableAreasForPoint(const WebCore::IntPoint& point)
+{
+    std::vector<Platform::ScrollViewBase*> validReturn;
+    std::vector<Platform::ScrollViewBase*> emptyReturn;
+
+    HitTestResult result = m_webPage->m_mainFrame->eventHandler()->hitTestResultAtPoint(m_webPage->mapFromViewportToContents(point), false /*allowShadowContent*/);
+    Node* node = result.innerNonSharedNode();
+    if (!node || !node->renderer())
+        return emptyReturn;
+
+    RenderLayer* layer = node->renderer()->enclosingLayer();
+    do {
+        RenderObject* renderer = layer->renderer();
+
+        if (renderer->isRenderView()) {
+            if (RenderView* renderView = toRenderView(renderer)) {
+                FrameView* view = renderView->frameView();
+                if (!view)
+                    return emptyReturn;
+
+                if (canScrollInnerFrame(view->frame())) {
+                    pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(m_webPage, layer), this);
+                    continue;
+                }
+            }
+        } else if (canScrollRenderBox(layer->renderBox())) {
+            pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(m_webPage, layer), this);
+            continue;
+        }
+
+        // If we run into a fix positioned layer, set the last scrollable in-region object
+        // as not able to propagate scroll to its parent scrollable.
+        if (isNonRenderViewFixedPositionedContainer(layer) && validReturn.size()) {
+            Platform::ScrollViewBase* end = validReturn.back();
+            end->setCanPropagateScrollingToEnclosingScrollable(false);
+        }
+
+    } while (layer = parentLayer(layer));
+
+    if (validReturn.empty())
+        return emptyReturn;
+
+    // Post-calculate the visible window rects in reverse hit test order so
+    // we account for all and any clipping rects.
+    WebCore::IntRect recursiveClippingRect(WebCore::IntPoint::zero(), m_webPage->transformedViewportSize());
+
+    std::vector<Platform::ScrollViewBase*>::reverse_iterator rend = validReturn.rend();
+    for (std::vector<Platform::ScrollViewBase*>::reverse_iterator rit = validReturn.rbegin(); rit != rend; ++rit) {
+
+        InRegionScrollableArea* curr = static_cast<InRegionScrollableArea*>(*rit);
+        RenderLayer* layer = curr->layer();
+
+        if (layer && layer->renderer()->isRenderView()) { // #document case
+            FrameView* view = toRenderView(layer->renderer())->frameView();
+            ASSERT(view);
+            ASSERT(canScrollInnerFrame(view->frame()));
+
+            WebCore::IntRect frameWindowRect = m_webPage->mapToTransformed(m_webPage->getRecursiveVisibleWindowRect(view));
+            frameWindowRect.intersect(recursiveClippingRect);
+            curr->setVisibleWindowRect(frameWindowRect);
+            recursiveClippingRect = frameWindowRect;
+
+        } else { // RenderBox-based elements case (scrollable boxes (div's, p's, textarea's, etc)).
+
+            RenderBox* box = layer->renderBox();
+            ASSERT(box);
+            ASSERT(canScrollRenderBox(box));
+
+            WebCore::IntRect visibleWindowRect = enclosingIntRect(box->absoluteClippedOverflowRect());
+            visibleWindowRect = box->frame()->view()->contentsToWindow(visibleWindowRect);
+            visibleWindowRect = m_webPage->mapToTransformed(visibleWindowRect);
+            visibleWindowRect.intersect(recursiveClippingRect);
+
+            curr->setVisibleWindowRect(visibleWindowRect);
+            recursiveClippingRect = visibleWindowRect;
+        }
+    }
+
+    return validReturn;
+}
+
+bool InRegionScrollerPrivate::scrollNodeRecursively(WebCore::Node* node, const WebCore::IntSize& delta)
+{
+    if (delta.isZero())
+        return true;
+
+    if (!node)
+        return false;
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return false;
+
+    FrameView* view = renderer->view()->frameView();
+    if (!view)
+        return false;
+
+    // Try scrolling the renderer.
+    if (scrollRenderer(renderer, delta))
+        return true;
+
+    // We've hit the page, don't scroll it and return false.
+    if (view == m_webPage->m_mainFrame->view())
+        return false;
+
+    // Try scrolling the FrameView.
+    if (canScrollInnerFrame(view->frame())) {
+        IntSize viewDelta = delta;
+        IntPoint newViewOffset = view->scrollPosition();
+        IntPoint maxViewOffset = view->maximumScrollPosition();
+        adjustScrollDelta(maxViewOffset, newViewOffset, viewDelta);
+
+        if (!viewDelta.isZero()) {
+            view->setCanBlitOnScroll(false);
+
+            BackingStoreClient* backingStoreClient = m_webPage->backingStoreClientForFrame(view->frame());
+            if (backingStoreClient) {
+                backingStoreClient->setIsClientGeneratedScroll(true);
+                backingStoreClient->setIsScrollNotificationSuppressed(true);
+            }
+
+            setNode(view->frame()->document());
+
+            view->scrollBy(viewDelta);
+
+            if (backingStoreClient) {
+                backingStoreClient->setIsClientGeneratedScroll(false);
+                backingStoreClient->setIsScrollNotificationSuppressed(false);
+            }
+
+            return true;
+        }
+    }
+
+    // Try scrolling the node of the enclosing frame.
+    Frame* frame = node->document()->frame();
+    if (frame) {
+        Node* ownerNode = frame->ownerElement();
+        if (scrollNodeRecursively(ownerNode, delta))
+            return true;
+    }
+
+    return false;
+}
+
+bool InRegionScrollerPrivate::scrollRenderer(WebCore::RenderObject* renderer, const WebCore::IntSize& delta)
+{
+    RenderLayer* layer = renderer->enclosingLayer();
+    if (!layer)
+        return false;
+
+    // Try to scroll layer.
+    bool restrictedByLineClamp = false;
+    if (renderer->parent())
+        restrictedByLineClamp = !renderer->parent()->style()->lineClamp().isNone();
+
+    if (renderer->hasOverflowClip() && !restrictedByLineClamp) {
+        IntSize layerDelta = delta;
+        IntPoint maxOffset(layer->scrollWidth() - layer->renderBox()->clientWidth(), layer->scrollHeight() - layer->renderBox()->clientHeight());
+        IntPoint currentOffset(layer->scrollXOffset(), layer->scrollYOffset());
+        adjustScrollDelta(maxOffset, currentOffset, layerDelta);
+        if (!layerDelta.isZero()) {
+            setNode(enclosingLayerNode(layer));
+            IntPoint newOffset = currentOffset + layerDelta;
+            layer->scrollToOffset(IntSize(newOffset.x(), newOffset.y()));
+            renderer->repaint(true);
+            return true;
+        }
+    }
+
+    while (layer = layer->parent()) {
+        if (canScrollRenderBox(layer->renderBox()))
+            return scrollRenderer(layer->renderBox(), delta);
+    }
+
+    return false;
+}
+
+void InRegionScrollerPrivate::adjustScrollDelta(const WebCore::IntPoint& maxOffset, const WebCore::IntPoint& currentOffset, WebCore::IntSize& delta) const
+{
+    if (currentOffset.x() + delta.width() > maxOffset.x())
+        delta.setWidth(std::min(maxOffset.x() - currentOffset.x(), delta.width()));
+
+    if (currentOffset.x() + delta.width() < 0)
+        delta.setWidth(std::max(-currentOffset.x(), delta.width()));
+
+    if (currentOffset.y() + delta.height() > maxOffset.y())
+        delta.setHeight(std::min(maxOffset.y() - currentOffset.y(), delta.height()));
+
+    if (currentOffset.y() + delta.height() < 0)
+        delta.setHeight(std::max(-currentOffset.y(), delta.height()));
+}
+
+static bool canScrollInnerFrame(Frame* frame)
+{
+    if (!frame || !frame->view())
+        return false;
+
+    // Not having an owner element means that we are on the mainframe.
+    if (!frame->ownerElement())
+        return false;
+
+    ASSERT(frame != frame->page()->mainFrame());
+
+    IntSize visibleSize = frame->view()->visibleContentRect().size();
+    IntSize contentsSize = frame->view()->contentsSize();
+
+    bool canBeScrolled = contentsSize.height() > visibleSize.height() || contentsSize.width() > visibleSize.width();
+
+    // Lets also consider the 'overflow-{x,y} property set directly to the {i}frame tag.
+    return canBeScrolled && (frame->ownerElement()->scrollingMode() != ScrollbarAlwaysOff);
+}
+
+// The RenderBox::canbeScrolledAndHasScrollableArea method returns true for the
+// following scenario, for example:
+// (1) a div that has a vertical overflow but no horizontal overflow
+//     with overflow-y: hidden and overflow-x: auto set.
+// The version below fixes it.
+// FIXME: Fix RenderBox::canBeScrolledAndHasScrollableArea method instead.
+static bool canScrollRenderBox(RenderBox* box)
+{
+    if (!box || !box->hasOverflowClip())
+        return false;
+
+    if (box->scrollsOverflowX() && (box->scrollWidth() != box->clientWidth())
+        || box->scrollsOverflowY() && (box->scrollHeight() != box->clientHeight()))
+        return true;
+
+    Node* node = box->node();
+    return node && (node->rendererIsEditable() || node->isDocumentNode());
+}
+
+static RenderLayer* parentLayer(RenderLayer* layer)
+{
+    ASSERT(layer);
+    if (layer->parent())
+        return layer->parent();
+
+    RenderObject* renderer = layer->renderer();
+    if (renderer->document() && renderer->document()->ownerElement() && renderer->document()->ownerElement()->renderer())
+        return renderer->document()->ownerElement()->renderer()->enclosingLayer();
+
+    return 0;
+}
+
+// FIXME: Make RenderLayer::enclosingElement public so this one can be removed.
+static Node* enclosingLayerNode(RenderLayer* layer)
+{
+    for (RenderObject* r = layer->renderer(); r; r = r->parent()) {
+        if (Node* e = r->node())
+            return e;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static bool isNonRenderViewFixedPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    if (o->isRenderView())
+        return false;
+
+    return o->isOutOfFlowPositioned() && o->style()->position() == FixedPosition;
+}
+
+static void pushBackInRegionScrollable(std::vector<Platform::ScrollViewBase*>& vector, InRegionScrollableArea* scrollableArea, InRegionScrollerPrivate* scroller)
+{
+    ASSERT(scroller);
+    ASSERT(!scrollableArea->isNull());
+
+    scrollableArea->setCanPropagateScrollingToEnclosingScrollable(!isNonRenderViewFixedPositionedContainer(scrollableArea->layer()));
+    vector.push_back(scrollableArea);
+    if (vector.size() == 1) {
+        // FIXME: Use RenderLayer::renderBox()->node() instead?
+        scroller->setNode(enclosingLayerNode(scrollableArea->layer()));
+    }
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/Api/InRegionScroller.h b/Source/WebKit/blackberry/Api/InRegionScroller.h
new file mode 100644
index 000000000..c3d93a797
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/InRegionScroller.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InRegionScroller_h
+#define InRegionScroller_h
+
+#include "BlackBerryGlobal.h"
+
+#include <BlackBerryPlatformPrimitives.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class InRegionScrollerPrivate;
+class TouchEventHandler;
+class WebPagePrivate;
+
+class BLACKBERRY_EXPORT InRegionScroller {
+public:
+    InRegionScroller(WebPagePrivate*);
+    ~InRegionScroller();
+
+    bool compositedSetScrollPosition(unsigned /*camouflagedLayer*/, const Platform::IntPoint& /*scrollPosition*/);
+
+private:
+    friend class WebPagePrivate;
+    friend class TouchEventHandler;
+    InRegionScrollerPrivate *d;
+};
+
+}
+}
+
+#endif
diff --git a/Source/WebKit/blackberry/Api/InRegionScroller_p.h b/Source/WebKit/blackberry/Api/InRegionScroller_p.h
new file mode 100644
index 000000000..bc47f9651
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/InRegionScroller_p.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InRegionScroller_p_h
+#define InRegionScroller_p_h
+
+#include "IntSize.h"
+#include "IntPoint.h"
+
+#include <interaction/ScrollViewBase.h>
+#include <vector>
+
+namespace WebCore {
+class Frame;
+class Node;
+class RenderObject;
+}
+
+namespace BlackBerry {
+namespace WebKit {
+
+class WebPagePrivate;
+
+class InRegionScrollerPrivate {
+public:
+    InRegionScrollerPrivate(WebPagePrivate*);
+
+    void setNode(WebCore::Node*);
+    WebCore::Node* node() const;
+    void reset();
+
+    bool canScroll() const;
+    bool hasNode() const;
+
+    bool scrollBy(const Platform::IntSize& delta);
+    bool compositedSetScrollPosition(unsigned camouflagedLayer, const WebCore::IntPoint& scrollPosition);
+
+    std::vector<Platform::ScrollViewBase*> inRegionScrollableAreasForPoint(const WebCore::IntPoint&);
+
+    WebPagePrivate* m_webPage;
+
+private:
+    bool scrollNodeRecursively(WebCore::Node*, const WebCore::IntSize& delta);
+    bool scrollRenderer(WebCore::RenderObject*, const WebCore::IntSize& delta);
+    void adjustScrollDelta(const WebCore::IntPoint& maxOffset, const WebCore::IntPoint& currentOffset, WebCore::IntSize& delta) const;
+
+    RefPtr<WebCore::Node> m_inRegionScrollStartingNode;
+};
+
+}
+}
+
+#endif
diff --git a/Source/WebKit/blackberry/Api/JavaScriptVariant.cpp b/Source/WebKit/blackberry/Api/JavaScriptVariant.cpp
new file mode 100644
index 000000000..1967ae09b
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/JavaScriptVariant.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JavaScriptVariant.h"
+
+#include "JavaScriptVariant_p.h"
+#include "WebPage.h"
+#include <JSStringRef.h>
+#include <JSValueRef.h>
+#include <stdlib.h>
+#include <wtf/Vector.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+JavaScriptVariant JSValueRefToBlackBerryJavaScriptVariant(const JSGlobalContextRef& ctx, const JSValueRef& value)
+{
+    JavaScriptVariant returnValue;
+
+    switch (JSValueGetType(ctx, value)) {
+    case kJSTypeNull:
+        returnValue.setType(JavaScriptVariant::Null);
+        break;
+    case kJSTypeBoolean:
+        returnValue.setBoolean(JSValueToBoolean(ctx, value));
+        break;
+    case kJSTypeNumber:
+        returnValue.setDouble(JSValueToNumber(ctx, value, 0));
+        break;
+    case kJSTypeString: {
+        JSStringRef stringRef = JSValueToStringCopy(ctx, value, 0);
+        size_t bufferSize = JSStringGetMaximumUTF8CStringSize(stringRef);
+        WTF::Vector<char> buffer(bufferSize);
+        JSStringGetUTF8CString(stringRef, buffer.data(), bufferSize);
+        returnValue.setString(WebString::fromUtf8(buffer.data()).utf8().c_str());
+        break;
+    }
+    case kJSTypeObject:
+        returnValue.setType(JavaScriptVariant::Object);
+        break;
+    case kJSTypeUndefined:
+        returnValue.setType(JavaScriptVariant::Undefined);
+        break;
+    }
+    return returnValue;
+}
+
+JSValueRef BlackBerryJavaScriptVariantToJSValueRef(const JSGlobalContextRef& ctx, const JavaScriptVariant& variant)
+{
+    JSValueRef ref = 0;
+    switch (variant.type()) {
+    case JavaScriptVariant::Undefined:
+        ref = JSValueMakeUndefined(ctx);
+        break;
+    case JavaScriptVariant::Null:
+        ref = JSValueMakeNull(ctx);
+        break;
+    case JavaScriptVariant::Boolean:
+        ref = JSValueMakeBoolean(ctx, variant.booleanValue());
+        break;
+    case JavaScriptVariant::Number:
+        ref = JSValueMakeNumber(ctx, variant.doubleValue());
+        break;
+    case JavaScriptVariant::String: {
+        JSStringRef str = JSStringCreateWithUTF8CString(variant.stringValue());
+        ref = JSValueMakeString(ctx, str);
+        JSStringRelease(str);
+        break;
+    }
+    case JavaScriptVariant::Exception:
+    case JavaScriptVariant::Object:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    return ref;
+}
+
+JavaScriptVariant::JavaScriptVariant()
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+}
+
+JavaScriptVariant::JavaScriptVariant(double value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setDouble(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(int value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setDouble(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(const char* value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setString(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(const std::string& value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setString(value.c_str());
+}
+
+JavaScriptVariant::JavaScriptVariant(bool value)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    setBoolean(value);
+}
+
+JavaScriptVariant::JavaScriptVariant(const JavaScriptVariant &v)
+    : m_type(Undefined)
+    , m_stringValue(0)
+{
+    this->operator=(v);
+}
+
+JavaScriptVariant::~JavaScriptVariant()
+{
+    // Prevent memory leaks if we have strings
+    setType(Undefined);
+}
+
+JavaScriptVariant& JavaScriptVariant::operator=(const JavaScriptVariant& v)
+{
+    switch (v.type()) {
+    case Boolean:
+        setBoolean(v.booleanValue());
+        break;
+    case Number:
+        setDouble(v.doubleValue());
+        break;
+    case String:
+        setString(v.stringValue());
+        break;
+    default:
+        setType(v.type());
+        break;
+    }
+
+    return *this;
+}
+
+void JavaScriptVariant::setType(const DataType& type)
+{
+    if (m_type == String)
+        free(m_stringValue);
+    m_type = type;
+    m_stringValue = 0;
+}
+
+JavaScriptVariant::DataType JavaScriptVariant::type() const
+{
+    return m_type;
+}
+
+void JavaScriptVariant::setDouble(double value)
+{
+    setType(Number);
+    m_doubleValue = value;
+}
+
+double JavaScriptVariant::doubleValue() const
+{
+    return m_doubleValue;
+}
+
+void JavaScriptVariant::setString(const char* value)
+{
+    setType(String);
+    m_stringValue = strdup(value);
+}
+
+char* JavaScriptVariant::stringValue() const
+{
+    return m_stringValue;
+}
+
+void JavaScriptVariant::setBoolean(bool value)
+{
+    setType(Boolean);
+    m_booleanValue = value;
+}
+
+bool JavaScriptVariant::booleanValue() const
+{
+    return m_booleanValue;
+}
+
+}
+}
diff --git a/Source/WebKit/blackberry/Api/JavaScriptVariant.h b/Source/WebKit/blackberry/Api/JavaScriptVariant.h
new file mode 100644
index 000000000..7623a56b0
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/JavaScriptVariant.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JavaScriptVariant_h
+#define JavaScriptVariant_h
+
+#include "BlackBerryGlobal.h"
+
+#include <string>
+
+namespace BlackBerry {
+namespace WebKit {
+
+class BLACKBERRY_EXPORT JavaScriptVariant {
+public:
+    enum DataType {
+        Undefined = 0,
+        Null,
+        Boolean,
+        Number,
+        String,
+        Object,
+        Exception
+    };
+
+    JavaScriptVariant();
+    JavaScriptVariant(const JavaScriptVariant&);
+    JavaScriptVariant(double);
+    JavaScriptVariant(int);
+    JavaScriptVariant(const char*);
+    JavaScriptVariant(bool);
+    JavaScriptVariant(const std::string&);
+    ~JavaScriptVariant();
+
+    JavaScriptVariant& operator=(const JavaScriptVariant&);
+
+    void setType(const DataType&);
+    DataType type() const;
+
+    void setDouble(double);
+    double doubleValue() const;
+
+    void setString(const char*);
+    char* stringValue() const;
+
+    void setBoolean(bool);
+    bool booleanValue() const;
+
+private:
+    DataType m_type;
+
+    union {
+        bool m_booleanValue;
+        double m_doubleValue;
+        char* m_stringValue;
+    };
+};
+
+}
+}
+
+#endif // JavaScriptVariant_h
diff --git a/Source/WebKit/blackberry/Api/JavaScriptVariant_p.h b/Source/WebKit/blackberry/Api/JavaScriptVariant_p.h
new file mode 100644
index 000000000..024b878cd
--- /dev/null
+++ b/Source/WebKit/blackberry/Api/JavaScriptVariant_p.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JavaScriptVariant_p_h
+#define JavaScriptVariant_p_h
+
+#include "JavaScriptVariant.h"
+
+#include <JSContextRef.h>
+#include <JSValueRef.h>
+
+namespace BlackBerry {
+namespace WebKit {
+
+JavaScriptVariant JSValueRefToBlackBerryJavaScriptVariant(const JSGlobalContextRef&, const JSValueRef&);
+JSValueRef BlackBerryJavaScriptVariantToJSValueRef(const JSGlobalContextRef&, const JavaScriptVariant&);
+
+}
+}
+
+#endif // JavaScriptVariant_p_h
diff --git a/Source/WebKit/blackberry/Api/WebOverlay.cpp b/Source/WebKit/blackberry/Api/WebOverlay.cpp
index f8bdbead4..abafe7139 100644
--- a/Source/WebKit/blackberry/Api/WebOverlay.cpp
+++ b/Source/WebKit/blackberry/Api/WebOverlay.cpp
@@ -232,15 +232,10 @@ void WebOverlayPrivate::drawContents(SkCanvas* canvas)
 
 void WebOverlayPrivate::scheduleCompositingRun()
 {
-    if (WebPagePrivate* page = this->page()) {
-        if (WebPageCompositorClient* compositorClient = page->compositor()->client()) {
-            double animationTime = compositorClient->requestAnimationFrame();
-            compositorClient->invalidate(animationTime);
-            return;
-        }
+    if (!page())
+        return;
 
-        page->blitVisibleContents();
-    }
+    page()->scheduleCompositingRun();
 }
 
 WebOverlayPrivateWebKitThread::WebOverlayPrivateWebKitThread(GraphicsLayerClient* client)
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index a8d44aff1..3819523ae 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -71,12 +71,14 @@
 #include "IconDatabaseClientBlackBerry.h"
 #include "InPageSearchManager.h"
 #include "InRegionScrollableArea.h"
+#include "InRegionScroller_p.h"
 #include "InputHandler.h"
 #include "InspectorBackendDispatcher.h"
 #include "InspectorClientBlackBerry.h"
 #include "InspectorController.h"
 #include "InspectorOverlay.h"
 #include "JavaScriptDebuggerBlackBerry.h"
+#include "JavaScriptVariant_p.h"
 #include "LayerWebKitThread.h"
 #include "NetworkManager.h"
 #include "NodeRenderStyle.h"
@@ -104,6 +106,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "ScrollTypes.h"
+#include "SecurityPolicy.h"
 #include "SelectionHandler.h"
 #include "SelectionOverlay.h"
 #include "Settings.h"
@@ -144,6 +147,7 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "FrameLayers.h"
+#include "WebPageCompositorClient.h"
 #include "WebPageCompositor_p.h"
 #endif
 
@@ -370,9 +374,6 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
 #if ENABLE(EVENT_MODE_METATAGS)
     , m_cursorEventMode(ProcessedCursorEvents)
     , m_touchEventMode(ProcessedTouchEvents)
-#if ENABLE(FULLSCREEN_API)
-    , m_touchEventModePriorGoingFullScreen(ProcessedTouchEvents)
-#endif
 #endif
 #if ENABLE(FULLSCREEN_API) && ENABLE(VIDEO)
     , m_scaleBeforeFullScreen(-1.0)
@@ -392,7 +393,6 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_lastUserEventTimestamp(0.0)
     , m_pluginMouseButtonPressed(false)
     , m_pluginMayOpenNewTab(false)
-    , m_inRegionScrollStartingNode(0)
 #if USE(ACCELERATED_COMPOSITING)
     , m_rootLayerCommitTimer(adoptPtr(new Timer<WebPagePrivate>(this, &WebPagePrivate::rootLayerCommitTimerFired)))
     , m_needsOneShotDrawingSynchronization(false)
@@ -536,6 +536,7 @@ void WebPagePrivate::init(const WebString& pageGroupName)
 
     m_webSettings = WebSettings::createFromStandardSettings();
     m_webSettings->setUserAgentString(defaultUserAgent());
+    m_page->setDeviceScaleFactor(m_webSettings->devicePixelRatio());
 
 #if USE(ACCELERATED_COMPOSITING)
     m_tapHighlight = DefaultTapHighlight::create(this);
@@ -557,6 +558,8 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     frameLoaderClient->setFrame(m_mainFrame, this);
     m_mainFrame->init();
 
+    m_inRegionScroller = adoptPtr(new InRegionScroller(this));
+
 #if ENABLE(WEBGL)
     Platform::Settings* settings = Platform::Settings::instance();
     m_page->settings()->setWebGLEnabled(settings && settings->isWebGLSupported());
@@ -844,24 +847,25 @@ bool WebPage::executeJavaScriptInIsolatedWorld(const char* script, JavaScriptDat
     return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
 }
 
-bool WebPage::executeJavaScriptFunction(const std::vector<std::string> &function, const std::vector<std::string> &args, JavaScriptDataType& returnType, WebString& returnValue)
+void WebPage::executeJavaScriptFunction(const std::vector<std::string> &function, const std::vector<JavaScriptVariant> &args, JavaScriptVariant& returnValue)
 {
-    if (!d->m_mainFrame)
-        return false;
+    if (!d->m_mainFrame) {
+        returnValue.setType(JavaScriptVariant::Exception);
+        return;
+    }
+
     JSC::Bindings::RootObject* root = d->m_mainFrame->script()->bindingRootObject();
-    if (!root)
-        return false;
+    if (!root) {
+        returnValue.setType(JavaScriptVariant::Exception);
+        return;
+    }
+
     JSC::ExecState* exec = root->globalObject()->globalExec();
     JSGlobalContextRef ctx = toGlobalRef(exec);
 
-    WTF::Vector<JSStringRef> argList(args.size());
     WTF::Vector<JSValueRef> argListRef(args.size());
-    for (unsigned i = 0; i < args.size(); ++i) {
-        JSStringRef str = JSStringCreateWithUTF8CString(args[i].c_str());
-        argList[i] = str;
-        JSValueRef strRef = JSValueMakeString(ctx, str);
-        argListRef[i] = strRef;
-    }
+    for (unsigned i = 0; i < args.size(); ++i)
+        argListRef[i] = BlackBerryJavaScriptVariantToJSValueRef(ctx, args[i]);
 
     JSValueRef windowObjectValue = windowObject();
     JSObjectRef obj = JSValueToObject(ctx, windowObjectValue, 0);
@@ -880,49 +884,13 @@ bool WebPage::executeJavaScriptFunction(const std::vector<std::string> &function
     if (functionObject && thisObject)
         result = JSObjectCallAsFunction(ctx, functionObject, thisObject, args.size(), argListRef.data(), 0);
 
-    for (unsigned i = 0; i < args.size(); ++i)
-        JSStringRelease(argList[i]);
-
     JSC::JSValue value = toJS(exec, result);
-
     if (!value) {
-        returnType = JSException;
-        return false;
-    }
-
-    JSType type = JSValueGetType(ctx, result);
-
-    switch (type) {
-    case kJSTypeNull:
-        returnType = JSNull;
-        break;
-    case kJSTypeBoolean:
-        returnType = JSBoolean;
-        break;
-    case kJSTypeNumber:
-        returnType = JSNumber;
-        break;
-    case kJSTypeString:
-        returnType = JSString;
-        break;
-    case kJSTypeObject:
-        returnType = JSObject;
-        break;
-    case kJSTypeUndefined:
-    default:
-        returnType = JSUndefined;
-        break;
-    }
-
-    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject) {
-        JSStringRef stringRef = JSValueToStringCopy(ctx, result, 0);
-        size_t bufferSize = JSStringGetMaximumUTF8CStringSize(stringRef);
-        WTF::Vector<char> buffer(bufferSize);
-        JSStringGetUTF8CString(stringRef, buffer.data(), bufferSize);
-        returnValue = WebString::fromUtf8(buffer.data());
+        returnValue.setType(JavaScriptVariant::Exception);
+        return;
     }
 
-    return true;
+    returnValue = JSValueRefToBlackBerryJavaScriptVariant(ctx, result);
 }
 
 void WebPagePrivate::stopCurrentLoad()
@@ -1002,6 +970,36 @@ void WebPage::enableCrossSiteXHR()
     d->enableCrossSiteXHR();
 }
 
+void WebPagePrivate::addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    RefPtr<SecurityOrigin> source = SecurityOrigin::createFromString(sourceOrigin);
+    if (source->isUnique())
+        return;
+
+    KURL destination(KURL(), destinationOrigin);
+    SecurityPolicy::addOriginAccessWhitelistEntry(*source, destination.protocol(), destination.host(), allowDestinationSubdomains);
+}
+
+void WebPage::addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    d->addOriginAccessWhitelistEntry(sourceOrigin, destinationOrigin, allowDestinationSubdomains);
+}
+
+void WebPagePrivate::removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    RefPtr<SecurityOrigin> source = SecurityOrigin::createFromString(sourceOrigin);
+    if (source->isUnique())
+        return;
+
+    KURL destination(KURL(), destinationOrigin);
+    SecurityPolicy::removeOriginAccessWhitelistEntry(*source, destination.protocol(), destination.host(), allowDestinationSubdomains);
+}
+
+void WebPage::removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains)
+{
+    d->removeOriginAccessWhitelistEntry(sourceOrigin, destinationOrigin, allowDestinationSubdomains);
+}
+
 void WebPagePrivate::setLoadState(LoadState state)
 {
     if (m_loadState == state)
@@ -1491,15 +1489,13 @@ bool WebPagePrivate::scrollBy(int deltaX, int deltaY, bool scrollMainFrame)
             delta.width() < 0 ? -untransformedCopiedDelta.width() : untransformedCopiedDelta.width(),
             delta.height() < 0 ? -untransformedCopiedDelta.height(): untransformedCopiedDelta.height());
 
-        if (m_inRegionScrollStartingNode) {
-            if (scrollNodeRecursively(m_inRegionScrollStartingNode.get(), delta)) {
-                m_selectionHandler->selectionPositionChanged();
-                // FIXME: We have code in place to handle scrolling and clipping tap highlight
-                // on in-region scrolling. As soon as it is fast enough (i.e. we have it backed by
-                // a backing store), we can reliably make use of it in the real world.
-                // m_touchEventHandler->drawTapHighlight();
-                return true;
-            }
+        if (m_inRegionScroller->d->scrollBy(delta)) {
+            m_selectionHandler->selectionPositionChanged();
+            // FIXME: We have code in place to handle scrolling and clipping tap highlight
+            // on in-region scrolling. As soon as it is fast enough (i.e. we have it backed by
+            // a backing store), we can reliably make use of it in the real world.
+            // m_touchEventHandler->drawTapHighlight();
+            return true;
         }
 
         return false;
@@ -1519,9 +1515,9 @@ bool WebPage::scrollBy(const Platform::IntSize& delta, bool scrollMainFrame)
 
 void WebPagePrivate::notifyInRegionScrollStatusChanged(bool status)
 {
-    if (!status && m_inRegionScrollStartingNode) {
-        enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(m_inRegionScrollStartingNode.get());
-        m_inRegionScrollStartingNode = 0;
+    if (!status && m_inRegionScroller->d->hasNode()) {
+        enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(m_inRegionScroller->d->node());
+        m_inRegionScroller->d->reset();
     }
 }
 
@@ -2085,7 +2081,6 @@ void WebPagePrivate::notifyTransformedContentsSizeChanged()
     const IntSize size = transformedContentsSize();
     m_backingStore->d->contentsSizeChanged(size);
     m_client->contentsSizeChanged(size);
-    m_selectionHandler->selectionPositionChanged();
 }
 
 void WebPagePrivate::notifyTransformedScrollChanged()
@@ -2357,6 +2352,20 @@ Platform::WebContext WebPagePrivate::webContext(TargetDetectionStrategy strategy
     if (!m_currentContextNode)
         return context;
 
+    // Send an onContextMenu event to the current context ndoe and get the result. Since we've already figured out
+    // which node we want, we can send it directly to the node and not do a hit test. The onContextMenu event doesn't require
+    // mouse positions so we just set the position at (0,0)
+    PlatformMouseEvent mouseEvent(IntPoint(), IntPoint(), PlatformEvent::MouseMoved, 0, NoButton, TouchScreen);
+    if (m_currentContextNode->dispatchMouseEvent(mouseEvent, eventNames().contextmenuEvent, 0)) {
+        context.setFlag(Platform::WebContext::IsOnContextMenuPrevented);
+        return context;
+    }
+
+    // Unpress the mouse button if we're actually getting context.
+    EventHandler* eventHandler = focusedOrMainFrame()->eventHandler();
+    if (eventHandler->mousePressed())
+        eventHandler->setMousePressed(false);
+
     requestLayoutIfNeeded();
 
     bool nodeAllowSelectionOverride = false;
@@ -2591,8 +2600,8 @@ void WebPagePrivate::clearDocumentData(const Document* documentGoingAway)
     if (m_currentBlockZoomAdjustedNode && m_currentBlockZoomAdjustedNode->document() == documentGoingAway)
         m_currentBlockZoomAdjustedNode = 0;
 
-    if (m_inRegionScrollStartingNode && m_inRegionScrollStartingNode->document() == documentGoingAway)
-        m_inRegionScrollStartingNode = 0;
+    if (m_inRegionScroller->d->hasNode() && m_inRegionScroller->d->node()->document() == documentGoingAway)
+        m_inRegionScroller->d->reset();
 
     if (documentGoingAway->frame())
         m_inputHandler->frameUnloaded(documentGoingAway->frame());
@@ -2612,15 +2621,6 @@ static bool isPositionedContainer(RenderLayer* layer)
     return o->isRenderView() || o->isOutOfFlowPositioned() || o->isRelPositioned() || layer->hasTransform();
 }
 
-static bool isNonRenderViewFixedPositionedContainer(RenderLayer* layer)
-{
-    RenderObject* o = layer->renderer();
-    if (o->isRenderView())
-        return false;
-
-    return o->isOutOfFlowPositioned() && o->style()->position() == FixedPosition;
-}
-
 static bool isFixedPositionedContainer(RenderLayer* layer)
 {
     RenderObject* o = layer->renderer();
@@ -2761,10 +2761,6 @@ PassRefPtr<Node> WebPagePrivate::contextNode(TargetDetectionStrategy strategy)
     const FatFingersResult lastFatFingersResult = m_touchEventHandler->lastFatFingersResult();
     bool isTouching = lastFatFingersResult.isValid() && strategy == RectBased;
 
-    // Unpress the mouse button always.
-    if (eventHandler->mousePressed())
-        eventHandler->setMousePressed(false);
-
     // Check if we're using LinkToLink and the user is not touching the screen.
     if (m_webSettings->doesGetFocusNodeContext() && !isTouching) {
         RefPtr<Node> node;
@@ -3392,7 +3388,7 @@ void WebPagePrivate::updateDelegatedOverlays(bool dispatched)
     if (Platform::webKitThreadMessageClient()->isCurrentThread()) {
         // Must be called on the WebKit thread.
         if (m_selectionHandler->isSelectionActive())
-            m_selectionHandler->selectionPositionChanged(true /* visualChangeOnly */);
+            m_selectionHandler->selectionPositionChanged();
         if (m_inspectorOverlay)
             m_inspectorOverlay->update();
 
@@ -3536,16 +3532,13 @@ void WebPage::resetVirtualViewportOnCommitted(bool reset)
 IntSize WebPagePrivate::recomputeVirtualViewportFromViewportArguments()
 {
     static const ViewportArguments defaultViewportArguments;
-    if (m_viewportArguments == defaultViewportArguments) {
-        m_page->setDeviceScaleFactor(1.0);
+    if (m_viewportArguments == defaultViewportArguments)
         return IntSize();
-    }
 
     int desktopWidth = defaultMaxLayoutSize().width();
     int deviceWidth = Platform::Graphics::Screen::primaryScreen()->width();
     int deviceHeight = Platform::Graphics::Screen::primaryScreen()->height();
     ViewportAttributes result = computeViewportAttributes(m_viewportArguments, desktopWidth, deviceWidth, deviceHeight, m_webSettings->devicePixelRatio(), m_defaultLayoutSize);
-    m_page->setDeviceScaleFactor(result.devicePixelRatio);
 
     setUserScalable(m_userScalable && result.userScalable);
     if (result.initialScale > 0)
@@ -3891,6 +3884,8 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
         IntRect actualVisibleRect = enclosingIntRect(rotationMatrix.inverse().mapRect(FloatRect(viewportRect)));
         m_mainFrame->view()->setFixedReportedSize(actualVisibleRect.size());
         m_mainFrame->view()->repaintFixedElementsAfterScrolling();
+        requestLayoutIfNeeded();
+        m_mainFrame->view()->updateFixedElementsAfterScrolling();
     }
 
     // We're going to need to send a resize event to JavaScript because
@@ -4183,12 +4178,12 @@ bool WebPage::touchEvent(const Platform::TouchEvent& event)
 
 void WebPagePrivate::setScrollOriginPoint(const Platform::IntPoint& point)
 {
-    m_inRegionScrollStartingNode = 0;
+    m_inRegionScroller->d->reset();
 
     if (!m_hasInRegionScrollableAreas)
         return;
 
-    m_client->notifyInRegionScrollingStartingPointChanged(inRegionScrollableAreasForPoint(point));
+    m_client->notifyInRegionScrollingStartingPointChanged(m_inRegionScroller->d->inRegionScrollableAreasForPoint(point));
 }
 
 void WebPage::setScrollOriginPoint(const Platform::IntPoint& point)
@@ -4358,120 +4353,6 @@ void WebPage::setForcedTextEncoding(const char* encoding)
         return d->focusedOrMainFrame()->loader()->reloadWithOverrideEncoding(encoding);
 }
 
-bool WebPagePrivate::scrollNodeRecursively(Node* node, const IntSize& delta)
-{
-    if (delta.isZero())
-        return true;
-
-    if (!node)
-        return false;
-
-    RenderObject* renderer = node->renderer();
-    if (!renderer)
-        return false;
-
-    FrameView* view = renderer->view()->frameView();
-    if (!view)
-        return false;
-
-    // Try scrolling the renderer.
-    if (scrollRenderer(renderer, delta))
-        return true;
-
-    // We've hit the page, don't scroll it and return false.
-    if (view == m_mainFrame->view())
-        return false;
-
-    // Try scrolling the FrameView.
-    if (canScrollInnerFrame(view->frame())) {
-        IntSize viewDelta = delta;
-        IntPoint newViewOffset = view->scrollPosition();
-        IntPoint maxViewOffset = view->maximumScrollPosition();
-        adjustScrollDelta(maxViewOffset, newViewOffset, viewDelta);
-
-        if (!viewDelta.isZero()) {
-            view->setCanBlitOnScroll(false);
-
-            BackingStoreClient* backingStoreClient = backingStoreClientForFrame(view->frame());
-            if (backingStoreClient) {
-                backingStoreClient->setIsClientGeneratedScroll(true);
-                backingStoreClient->setIsScrollNotificationSuppressed(true);
-            }
-
-            m_inRegionScrollStartingNode = view->frame()->document();
-
-            view->scrollBy(viewDelta);
-
-            if (backingStoreClient) {
-                backingStoreClient->setIsClientGeneratedScroll(false);
-                backingStoreClient->setIsScrollNotificationSuppressed(false);
-            }
-
-            return true;
-        }
-    }
-
-    // Try scrolling the node of the enclosing frame.
-    Frame* frame = node->document()->frame();
-    if (frame) {
-        Node* ownerNode = frame->ownerElement();
-        if (scrollNodeRecursively(ownerNode, delta))
-            return true;
-    }
-
-    return false;
-}
-
-void WebPagePrivate::adjustScrollDelta(const IntPoint& maxOffset, const IntPoint& currentOffset, IntSize& delta) const
-{
-    if (currentOffset.x() + delta.width() > maxOffset.x())
-        delta.setWidth(min(maxOffset.x() - currentOffset.x(), delta.width()));
-
-    if (currentOffset.x() + delta.width() < 0)
-        delta.setWidth(max(-currentOffset.x(), delta.width()));
-
-    if (currentOffset.y() + delta.height() > maxOffset.y())
-        delta.setHeight(min(maxOffset.y() - currentOffset.y(), delta.height()));
-
-    if (currentOffset.y() + delta.height() < 0)
-        delta.setHeight(max(-currentOffset.y(), delta.height()));
-}
-
-static Node* enclosingLayerNode(RenderLayer*);
-
-bool WebPagePrivate::scrollRenderer(RenderObject* renderer, const IntSize& delta)
-{
-    RenderLayer* layer = renderer->enclosingLayer();
-    if (!layer)
-        return false;
-
-    // Try to scroll layer.
-    bool restrictedByLineClamp = false;
-    if (renderer->parent())
-        restrictedByLineClamp = !renderer->parent()->style()->lineClamp().isNone();
-
-    if (renderer->hasOverflowClip() && !restrictedByLineClamp) {
-        IntSize layerDelta = delta;
-        IntPoint maxOffset(layer->scrollWidth() - layer->renderBox()->clientWidth(), layer->scrollHeight() - layer->renderBox()->clientHeight());
-        IntPoint currentOffset(layer->scrollXOffset(), layer->scrollYOffset());
-        adjustScrollDelta(maxOffset, currentOffset, layerDelta);
-        if (!layerDelta.isZero()) {
-            m_inRegionScrollStartingNode = enclosingLayerNode(layer);
-            IntPoint newOffset = currentOffset + layerDelta;
-            layer->scrollToOffset(toSize(newOffset));
-            renderer->repaint(true);
-            return true;
-        }
-    }
-
-    while (layer = layer->parent()) {
-        if (canScrollRenderBox(layer->renderBox()))
-            return scrollRenderer(layer->renderBox(), delta);
-    }
-
-    return false;
-}
-
 static void handleScrolling(unsigned short character, WebPagePrivate* scroller)
 {
     const int scrollFactor = 20;
@@ -4735,172 +4616,14 @@ void WebPage::selectAtPoint(const Platform::IntPoint& location)
     d->m_selectionHandler->selectAtPoint(selectionLocation);
 }
 
-// FIXME: Move to DOMSupport.
-bool WebPagePrivate::canScrollInnerFrame(Frame* frame) const
-{
-    if (!frame || !frame->view())
-        return false;
-
-    // Not having an owner element means that we are on the mainframe.
-    if (!frame->ownerElement())
-        return false;
-
-    ASSERT(frame != m_mainFrame);
-
-    IntSize visibleSize = frame->view()->visibleContentRect().size();
-    IntSize contentsSize = frame->view()->contentsSize();
-
-    bool canBeScrolled = contentsSize.height() > visibleSize.height() || contentsSize.width() > visibleSize.width();
-
-    // Lets also consider the 'overflow-{x,y} property set directly to the {i}frame tag.
-    return canBeScrolled && (frame->ownerElement()->scrollingMode() != ScrollbarAlwaysOff);
-}
-
-// The RenderBox::canbeScrolledAndHasScrollableArea method returns true for the
-// following scenario, for example:
-// (1) a div that has a vertical overflow but no horizontal overflow
-//     with overflow-y: hidden and overflow-x: auto set.
-// The version below fixes it.
-// FIXME: Fix RenderBox::canBeScrolledAndHasScrollableArea method instead.
-bool WebPagePrivate::canScrollRenderBox(RenderBox* box)
-{
-    if (!box || !box->hasOverflowClip())
-        return false;
-
-    if (box->scrollsOverflowX() && (box->scrollWidth() != box->clientWidth())
-        || box->scrollsOverflowY() && (box->scrollHeight() != box->clientHeight()))
-        return true;
-
-    Node* node = box->node();
-    return node && (node->rendererIsEditable() || node->isDocumentNode());
-}
-
-static RenderLayer* parentLayer(RenderLayer* layer)
-{
-    ASSERT(layer);
-    if (layer->parent())
-        return layer->parent();
-
-    RenderObject* renderer = layer->renderer();
-    if (renderer->document() && renderer->document()->ownerElement() && renderer->document()->ownerElement()->renderer())
-        return renderer->document()->ownerElement()->renderer()->enclosingLayer();
-
-    return 0;
-}
-
-// FIXME: Make RenderLayer::enclosingElement public so this one can be removed.
-static Node* enclosingLayerNode(RenderLayer* layer)
-{
-    for (RenderObject* r = layer->renderer(); r; r = r->parent()) {
-        if (Node* e = r->node())
-            return e;
-    }
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-static void pushBackInRegionScrollable(std::vector<Platform::ScrollViewBase*>& vector, InRegionScrollableArea* scroller, WebPagePrivate* webPage)
-{
-    ASSERT(webPage);
-    ASSERT(!scroller.isNull());
-
-    scroller->setCanPropagateScrollingToEnclosingScrollable(!isNonRenderViewFixedPositionedContainer(scroller->layer()));
-    vector.push_back(scroller);
-    if (vector.size() == 1) {
-        // FIXME: Use RenderLayer::renderBox()->node() instead?
-        webPage->m_inRegionScrollStartingNode = enclosingLayerNode(scroller->layer());
-    }
-}
-
-std::vector<Platform::ScrollViewBase*> WebPagePrivate::inRegionScrollableAreasForPoint(const Platform::IntPoint& point)
+BackingStore* WebPage::backingStore() const
 {
-    std::vector<Platform::ScrollViewBase*> validReturn;
-    std::vector<Platform::ScrollViewBase*> emptyReturn;
-
-    HitTestResult result = m_mainFrame->eventHandler()->hitTestResultAtPoint(mapFromViewportToContents(point), false /*allowShadowContent*/);
-    Node* node = result.innerNonSharedNode();
-    if (!node)
-        return emptyReturn;
-
-    RenderObject* renderer = node->renderer();
-    // FIXME: Validate with elements with visibility:hidden.
-    if (!renderer)
-        return emptyReturn;
-
-    RenderLayer* layer = renderer->enclosingLayer();
-    do {
-        RenderObject* renderer = layer->renderer();
-
-        if (renderer->isRenderView()) {
-            if (RenderView* renderView = toRenderView(renderer)) {
-                FrameView* view = renderView->frameView();
-                if (!view)
-                    return emptyReturn;
-
-                if (canScrollInnerFrame(view->frame())) {
-                    pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(this, layer), this);
-                    continue;
-                }
-            }
-        } else if (canScrollRenderBox(layer->renderBox())) {
-            pushBackInRegionScrollable(validReturn, new InRegionScrollableArea(this, layer), this);
-            continue;
-        }
-
-        // If we run into a fix positioned layer, set the last scrollable in-region object
-        // as not able to propagate scroll to its parent scrollable.
-        if (isNonRenderViewFixedPositionedContainer(layer) && validReturn.size()) {
-            Platform::ScrollViewBase* end = validReturn.back();
-            end->setCanPropagateScrollingToEnclosingScrollable(false);
-        }
-
-    } while (layer = parentLayer(layer));
-
-    if (validReturn.empty())
-        return emptyReturn;
-
-    // Post-calculate the visible window rects in reverse hit test order so
-    // we account for all and any clipping rects.
-    WebCore::IntRect recursiveClippingRect(WebCore::IntPoint::zero(), transformedViewportSize());
-
-    std::vector<Platform::ScrollViewBase*>::reverse_iterator rend = validReturn.rend();
-    for (std::vector<Platform::ScrollViewBase*>::reverse_iterator rit = validReturn.rbegin(); rit != rend; ++rit) {
-
-        InRegionScrollableArea* curr = static_cast<InRegionScrollableArea*>(*rit);
-        RenderLayer* layer = curr->layer();
-
-        if (layer && layer->renderer()->isRenderView()) { // #document case
-            FrameView* view = toRenderView(layer->renderer())->frameView();
-            ASSERT(view);
-            ASSERT(canScrollInnerFrame(view->frame()));
-
-            WebCore::IntRect frameWindowRect = mapToTransformed(getRecursiveVisibleWindowRect(view));
-            frameWindowRect.intersect(recursiveClippingRect);
-            curr->setVisibleWindowRect(frameWindowRect);
-            recursiveClippingRect = frameWindowRect;
-
-        } else { // RenderBox-based elements case (scrollable boxes (div's, p's, textarea's, etc)).
-
-            RenderBox* box = layer->renderBox();
-            ASSERT(box);
-            ASSERT(canScrollRenderBox(box));
-
-            WebCore::IntRect visibleWindowRect = box->absoluteClippedOverflowRect();
-            visibleWindowRect = box->frame()->view()->contentsToWindow(visibleWindowRect);
-            visibleWindowRect = mapToTransformed(visibleWindowRect);
-            visibleWindowRect.intersect(recursiveClippingRect);
-
-            curr->setVisibleWindowRect(visibleWindowRect);
-            recursiveClippingRect = visibleWindowRect;
-        }
-    }
-
-    return validReturn;
+    return d->m_backingStore;
 }
 
-BackingStore* WebPage::backingStore() const
+InRegionScroller* WebPage::inRegionScroller() const
 {
-    return d->m_backingStore;
+    return d->m_inRegionScroller.get();
 }
 
 bool WebPage::zoomToFit()
@@ -5391,13 +5114,12 @@ JSValueRef WebPage::windowObject() const
 // Serialize only the members of HistoryItem which are needed by the client,
 // and copy them into a SharedArray. Also include the HistoryItem pointer which
 // will be used by the client as an opaque reference to identify the item.
-void WebPage::getBackForwardList(SharedArray<BackForwardEntry>& result, unsigned int& resultSize) const
+void WebPage::getBackForwardList(SharedArray<BackForwardEntry>& result) const
 {
     HistoryItemVector entries = static_cast<BackForwardListImpl*>(d->m_page->backForward()->client())->entries();
-    resultSize = entries.size();
-    result.reset(new BackForwardEntry[resultSize]);
+    result.reset(new BackForwardEntry[entries.size()], entries.size());
 
-    for (unsigned i = 0; i < resultSize; ++i) {
+    for (unsigned i = 0; i < entries.size(); ++i) {
         RefPtr<HistoryItem> entry = entries[i];
         BackForwardEntry& resultEntry = result[i];
         resultEntry.url = entry->urlString();
@@ -5871,10 +5593,8 @@ LayerRenderingResults WebPagePrivate::lastCompositingResults() const
 
 GraphicsLayer* WebPagePrivate::overlayLayer()
 {
-    // The overlay layer has no GraphicsLayerClient, it's just a container
-    // for various overlays.
     if (!m_overlayLayer)
-        m_overlayLayer = GraphicsLayer::create(0);
+        m_overlayLayer = GraphicsLayer::create(this);
 
     return m_overlayLayer.get();
 }
@@ -5993,6 +5713,10 @@ bool WebPagePrivate::commitRootLayerIfNeeded()
     if (!view)
         return false;
 
+    // This can do pretty much anything depending on the overlay,
+    // so in case it causes relayout or schedule a commit, call it early.
+    updateDelegatedOverlays();
+
     // If we sync compositing layers when a layout is pending, we may cause painting of compositing
     // layer content to occur before layout has happened, which will cause paintContents() to bail.
     if (needsLayoutRecursive(view)) {
@@ -6015,7 +5739,6 @@ bool WebPagePrivate::commitRootLayerIfNeeded()
     if (m_frameLayers && m_frameLayers->hasLayer())
         m_frameLayers->commitOnWebKitThread(scale);
 
-    updateDelegatedOverlays();
     if (m_overlayLayer)
         m_overlayLayer->platformLayer()->commitOnWebKitThread(scale);
 
@@ -6236,6 +5959,21 @@ void WebPagePrivate::setNeedsOneShotDrawingSynchronization()
     m_needsCommit = true;
     m_needsOneShotDrawingSynchronization = true;
 }
+
+void WebPagePrivate::notifySyncRequired(const GraphicsLayer*)
+{
+    scheduleRootLayerCommit();
+}
+
+bool WebPagePrivate::showDebugBorders(const GraphicsLayer*) const
+{
+    return m_page->settings()->showDebugBorders();
+}
+
+bool WebPagePrivate::showRepaintCounter(const GraphicsLayer*) const
+{
+    return m_page->settings()->showRepaintCounter();
+}
 #endif // USE(ACCELERATED_COMPOSITING)
 
 void WebPagePrivate::enterFullscreenForNode(Node* node)
@@ -6318,19 +6056,12 @@ void WebPagePrivate::enterFullScreenForElement(Element* element)
         // is so that exitFullScreenForElement() gets called later.
         enterFullscreenForNode(element);
     } else {
-        // When an element goes fullscreen, it gets cloned and added to a higher index
-        // wrapper/container node, created out of the DOM tree. This wrapper is fixed
-        // position, but since our fixed position logic respects only the 'y' coordinate,
-        // we temporarily scroll the WebPage to x:0 so that the wrapper gets properly
-        // positioned. The original scroll position is restored once element leaves fullscreen.
+        // When an element goes fullscreen, the viewport size changes and the scroll
+        // position might change. So we keep track of it here, in order to restore it
+        // once element leaves fullscreen.
         WebCore::IntPoint scrollPosition = m_mainFrame->view()->scrollPosition();
         m_xScrollOffsetBeforeFullScreen = scrollPosition.x();
-        m_mainFrame->view()->setScrollPosition(WebCore::IntPoint(0, scrollPosition.y()));
 
-#if ENABLE(EVENT_MODE_METATAGS)
-        m_touchEventModePriorGoingFullScreen = m_touchEventMode;
-        didReceiveTouchEventMode(PureTouchEventsWithMouseConversion);
-#endif
         // The current scale can be clamped to a greater minimum scale when we relayout contents during
         // the change of the viewport size. Cache the current scale so that we can restore it when
         // leaving fullscreen. Otherwise, it is possible that we will use the wrong scale.
@@ -6365,10 +6096,6 @@ void WebPagePrivate::exitFullScreenForElement(Element* element)
             WebCore::IntPoint(m_xScrollOffsetBeforeFullScreen, scrollPosition.y()));
         m_xScrollOffsetBeforeFullScreen = -1;
 
-#if ENABLE(EVENT_MODE_METATAGS)
-        didReceiveTouchEventMode(m_touchEventModePriorGoingFullScreen);
-        m_touchEventModePriorGoingFullScreen = ProcessedTouchEvents;
-#endif
         if (m_scaleBeforeFullScreen > 0) {
             // Restore the scale when leaving fullscreen. We can't use TransformationMatrix::scale(double) here, as it
             // will multiply the scale rather than set the scale.
@@ -6535,6 +6262,18 @@ void WebPagePrivate::blitVisibleContents()
 
     m_backingStore->d->blitVisibleContents();
 }
+
+void WebPagePrivate::scheduleCompositingRun()
+{
+    if (WebPageCompositorClient* compositorClient = compositor()->client()) {
+        double animationTime = compositorClient->requestAnimationFrame();
+        compositorClient->invalidate(animationTime);
+        return;
+    }
+
+    blitVisibleContents();
+}
+
 #endif
 
 void WebPage::setWebGLEnabled(bool enabled)
@@ -6663,11 +6402,11 @@ PagePopupBlackBerry* WebPage::popup()
     return d->m_selectPopup;
 }
 
-void WebPagePrivate::setInspectorOverlayClient(WebCore::InspectorOverlay::InspectorOverlayClient* inspectorOverlayClient)
+void WebPagePrivate::setInspectorOverlayClient(InspectorOverlay::InspectorOverlayClient* inspectorOverlayClient)
 {
     if (inspectorOverlayClient) {
         if (!m_inspectorOverlay)
-            m_inspectorOverlay = WebCore::InspectorOverlay::create(this, inspectorOverlayClient);
+            m_inspectorOverlay = InspectorOverlay::create(this, inspectorOverlayClient);
         else
             m_inspectorOverlay->setClient(inspectorOverlayClient);
         m_inspectorOverlay->update();
@@ -6693,5 +6432,35 @@ void WebPagePrivate::setTextZoomFactor(float textZoomFactor)
 
     m_mainFrame->setTextZoomFactor(textZoomFactor);
 }
+
+void WebPagePrivate::restoreHistoryViewState(Platform::IntSize contentsSize, Platform::IntPoint scrollPosition, double scale, bool shouldReflowBlock)
+{
+    if (!m_mainFrame)
+        return;
+
+    m_backingStore->d->suspendScreenAndBackingStoreUpdates(); // don't flash checkerboard for the setScrollPosition call
+    m_mainFrame->view()->setContentsSizeFromHistory(contentsSize);
+
+    // Here we need to set scroll position what we asked for.
+    // So we use ScrollView::constrainsScrollingToContentEdge(false).
+    bool oldConstrainsScrollingToContentEdge = m_mainFrame->view()->constrainsScrollingToContentEdge();
+    m_mainFrame->view()->setConstrainsScrollingToContentEdge(false);
+    setScrollPosition(scrollPosition);
+    m_mainFrame->view()->setConstrainsScrollingToContentEdge(oldConstrainsScrollingToContentEdge);
+
+    m_shouldReflowBlock = shouldReflowBlock;
+
+    bool didZoom = zoomAboutPoint(scale, m_mainFrame->view()->scrollPosition(), true /* enforceScaleClamping */, true /*forceRendering*/, true /*isRestoringZoomLevel*/);
+    // If we're already at that scale, then we should still force rendering
+    // since our scroll position changed.
+    m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
+
+    if (!didZoom) {
+        // We need to notify the client of the scroll position and content size change(s) above even if we didn't scale.
+        notifyTransformedContentsSizeChanged();
+        notifyTransformedScrollChanged();
+    }
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
index c7227fe8d..06aabeb94 100644
--- a/Source/WebKit/blackberry/Api/WebPage.h
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -20,6 +20,7 @@
 #define WebPage_h
 
 #include "BlackBerryGlobal.h"
+#include "JavaScriptVariant.h"
 #include "WebString.h"
 
 #include <BlackBerryPlatformGuardedPointer.h>
@@ -63,6 +64,7 @@ namespace WebKit {
 class BackingStore;
 class BackingStoreClient;
 class BackingStorePrivate;
+class InRegionScroller;
 class RenderQueue;
 class WebOverlay;
 class WebPageClient;
@@ -105,7 +107,7 @@ public:
     // Takes a UTF16 encoded script that is used explicitly by the pattern matching code
     bool executeJavaScriptInIsolatedWorld(const std::wstring& script, JavaScriptDataType& returnType, WebString& returnValue);
 
-    bool executeJavaScriptFunction(const std::vector<std::string> &script, const std::vector<std::string> &args, JavaScriptDataType& returnType, WebString& returnValue);
+    void executeJavaScriptFunction(const std::vector<std::string> &function, const std::vector<JavaScriptVariant> &args, JavaScriptVariant& returnValue);
 
     void initializeIconDataBase();
 
@@ -117,6 +119,8 @@ public:
     void prepareToDestroy();
 
     void enableCrossSiteXHR();
+    void addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
+    void removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
 
     void reload();
     void reloadFromCache();
@@ -177,6 +181,8 @@ public:
 
     BackingStore* backingStore() const;
 
+    InRegionScroller* inRegionScroller() const;
+
     bool zoomToFit();
     bool zoomToOneOne();
     void zoomToInitialScale();
@@ -299,7 +305,7 @@ public:
     void goToBackForwardEntry(BackForwardId);
 
     int backForwardListLength() const;
-    void getBackForwardList(SharedArray<BackForwardEntry>& result, unsigned& resultLength) const;
+    void getBackForwardList(SharedArray<BackForwardEntry>& result) const;
     void releaseBackForwardEntry(BackForwardId) const;
     void clearBackForwardList(bool keepCurrentPage) const;
 
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
index 96fba7a52..0da7318b2 100644
--- a/Source/WebKit/blackberry/Api/WebPageClient.h
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -167,9 +167,9 @@ public:
     virtual void openDateTimePopup(int type, const WebString& value, const WebString& min, const WebString& max, double step) = 0;
     virtual void openColorPopup(const WebString& value) = 0;
 
-    virtual bool chooseFilenames(bool allowMultiple, const WebString& acceptTypes, const SharedArray<WebString>& initialFiles, unsigned initialFileSize, SharedArray<WebString>& chosenFiles, unsigned& chosenFileSize) = 0;
+    virtual bool chooseFilenames(bool allowMultiple, const SharedArray<WebString>& acceptTypes, const SharedArray<WebString>& initialFiles, const WebString& capture, SharedArray<WebString>& chosenFiles) = 0;
 
-    virtual void loadPluginForMimetype(int, int width, int height, const SharedArray<WebString>& paramNames, const SharedArray<WebString>& paramValues, int size, const char* url) = 0;
+    virtual void loadPluginForMimetype(int, int width, int height, const SharedArray<WebString>& paramNames, const SharedArray<WebString>& paramValues, const char* url) = 0;
     virtual void notifyPluginRectChanged(int, Platform::IntRect rectChanged) = 0;
     virtual void destroyPlugin(int) = 0;
     virtual void playMedia(int) = 0;
@@ -187,7 +187,7 @@ public:
     virtual unsigned long long databaseQuota(const unsigned short* origin, unsigned originLength, const unsigned short* databaseName, unsigned databaseNameLength, unsigned long long totalUsage, unsigned long long originUsage, unsigned long long estimatedSize) = 0;
 
     virtual void setIconForUrl(const char* originalPageUrl, const char* finalPageUrl, const char* iconUrl) = 0;
-    virtual void setFavicon(int width, int height, unsigned char* iconData, const char* url) = 0;
+    virtual void setFavicon(const char* dataInBase64, const char* url) = 0;
     virtual void setLargeIcon(const char* iconUrl) = 0;
     virtual void setWebAppCapable() = 0;
     virtual void setSearchProviderDetails(const char* title, const char* documentUrl) = 0;
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index 4ca76d39c..271ed0a39 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -20,10 +20,12 @@
 #define WebPage_p_h
 
 #include "ChromeClient.h"
+#include "InRegionScroller.h"
 #include "InspectorClientBlackBerry.h"
 #include "InspectorOverlay.h"
 #if USE(ACCELERATED_COMPOSITING)
 #include "GLES2Context.h"
+#include "GraphicsLayerClient.h"
 #include "LayerRenderer.h"
 #include <EGL/egl.h>
 #endif
@@ -82,7 +84,12 @@ class WebPageCompositorPrivate;
 // In WebPagePrivate, the screen size is called the transformedViewportSize,
 // the viewport position is called the transformedScrollPosition,
 // and the viewport size is called the transformedActualVisibleSize.
-class WebPagePrivate : public PageClientBlackBerry, public WebSettingsDelegate, public Platform::GuardedPointerBase {
+class WebPagePrivate : public PageClientBlackBerry
+                     , public WebSettingsDelegate
+#if USE(ACCELERATED_COMPOSITING)
+                     , public WebCore::GraphicsLayerClient
+#endif
+                     , public Platform::GuardedPointerBase {
 public:
     enum ViewMode { Mobile, Desktop, FixedDesktop };
     enum LoadState { None /* on instantiation of page */, Provisional, Committed, Finished, Failed };
@@ -106,6 +113,8 @@ public:
     void prepareToDestroy();
 
     void enableCrossSiteXHR();
+    void addOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
+    void removeOriginAccessWhitelistEntry(const char* sourceOrigin, const char* destinationOrigin, bool allowDestinationSubdomains);
 
     LoadState loadState() const { return m_loadState; }
     bool isLoading() const { return m_loadState == WebPagePrivate::Provisional || m_loadState == WebPagePrivate::Committed; }
@@ -126,7 +135,7 @@ public:
     WebCore::IntPoint calculateReflowedScrollPosition(const WebCore::FloatPoint& anchorOffset, double inverseScale);
     void setTextReflowAnchorPoint(const Platform::IntPoint& focalPoint);
 
-    void schedulePinchZoomAboutPoint(double scale, const WebCore::IntPoint& anchor);
+    void restoreHistoryViewState(Platform::IntSize contentsSize, Platform::IntPoint scrollPosition, double scale, bool shouldReflowBlock);
 
     // Perform actual zoom for block zoom.
     void zoomBlock();
@@ -141,7 +150,6 @@ public:
     bool scrollBy(int deltaX, int deltaY, bool scrollMainFrame = true);
 
     void enqueueRenderingOfClippedContentOfScrollableNodeAfterInRegionScrolling(WebCore::Node*);
-    std::vector<Platform::ScrollViewBase*> inRegionScrollableAreasForPoint(const Platform::IntPoint&);
     void notifyInRegionScrollStatusChanged(bool status);
     void setScrollOriginPoint(const Platform::IntPoint&);
     void setHasInRegionScrollableAreas(bool);
@@ -328,13 +336,6 @@ public:
     WebCore::Frame* focusedOrMainFrame() const;
     WebCore::Frame* mainFrame() const { return m_mainFrame; }
 
-    bool scrollNodeRecursively(WebCore::Node* originalNode, const WebCore::IntSize& delta);
-    bool scrollRenderer(WebCore::RenderObject* renderer, const WebCore::IntSize& delta);
-    void adjustScrollDelta(const WebCore::IntPoint& maxOffset, const WebCore::IntPoint& currentOffset, WebCore::IntSize& delta) const;
-
-    bool canScrollRenderBox(WebCore::RenderBox*);
-    bool canScrollInnerFrame(WebCore::Frame*) const;
-
 #if ENABLE(EVENT_MODE_METATAGS)
     void didReceiveCursorEventMode(WebCore::CursorEventMode);
     void didReceiveTouchEventMode(WebCore::TouchEventMode);
@@ -391,6 +392,13 @@ public:
     WebCore::LayerRenderingResults lastCompositingResults() const;
     WebCore::GraphicsLayer* overlayLayer();
 
+    // Fallback GraphicsLayerClient implementation, used for various overlay layers.
+    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
+    virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
+    virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip) { }
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
+
     // WebKit thread, plumbed through from ChromeClientBlackBerry.
     void setRootLayerWebKitThread(WebCore::Frame*, WebCore::LayerWebKitThread*);
     void setNeedsOneShotDrawingSynchronization();
@@ -415,6 +423,8 @@ public:
     void suspendRootLayerCommit();
     void resumeRootLayerCommit();
     void blitVisibleContents();
+
+    void scheduleCompositingRun();
 #endif
 
     bool dispatchTouchEventToFullScreenPlugin(WebCore::PluginView*, const Platform::TouchEvent&);
@@ -446,7 +456,7 @@ public:
 
     void deferredTasksTimerFired(WebCore::Timer<WebPagePrivate>*);
 
-    void setInspectorOverlayClient(WebCore::InspectorOverlay::InspectorOverlayClient*);
+    void setInspectorOverlayClient(InspectorOverlay::InspectorOverlayClient*);
 
     void applySizeOverride(int overrideWidth, int overrideHeight);
     void setTextZoomFactor(float);
@@ -508,9 +518,6 @@ public:
 #endif
 
 #if ENABLE(FULLSCREEN_API)
-#if ENABLE(EVENT_MODE_METATAGS)
-    WebCore::TouchEventMode m_touchEventModePriorGoingFullScreen;
-#endif
 #if ENABLE(VIDEO)
     double m_scaleBeforeFullScreen;
     int m_xScrollOffsetBeforeFullScreen;
@@ -554,7 +561,7 @@ public:
 
     HashSet<WebCore::PluginView*> m_pluginViews;
 
-    RefPtr<WebCore::Node> m_inRegionScrollStartingNode;
+    OwnPtr<InRegionScroller> m_inRegionScroller;
 
 #if USE(ACCELERATED_COMPOSITING)
     bool m_isAcceleratedCompositingActive;
@@ -587,7 +594,7 @@ public:
     RefPtr<WebCore::DOMWrapperWorld> m_isolatedWorld;
     bool m_hasInRegionScrollableAreas;
     bool m_updateDelegatedOverlaysDispatched;
-    OwnPtr<WebCore::InspectorOverlay> m_inspectorOverlay;
+    OwnPtr<InspectorOverlay> m_inspectorOverlay;
 
     // There is no need to initialize the following members in WebPagePrivate's constructor,
     // because they are only used by WebPageTasks and the tasks will initialize them when
diff --git a/Source/WebKit/blackberry/Api/WebSettings.cpp b/Source/WebKit/blackberry/Api/WebSettings.cpp
index dd3a9c49a..de6f505d7 100644
--- a/Source/WebKit/blackberry/Api/WebSettings.cpp
+++ b/Source/WebKit/blackberry/Api/WebSettings.cpp
@@ -161,6 +161,7 @@ WebSettings* WebSettings::standardSettings()
     settings = new WebSettings;
     settings->m_private->impl = new WebSettingsPrivate::WebSettingsPrivateImpl();
     settings->m_private->copyOnWrite = false;
+    settings->m_private->setBoolean(BlackBerryAllowCrossSiteRequests, false);
     settings->m_private->setUnsigned(BlackBerryBackgroundColor, WebCore::Color::white);
     settings->m_private->setBoolean(BlackBerryCookiesEnabled, true);
     settings->m_private->setDouble(BlackBerryInitialScale, -1);
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index ffaee6de6..ad8655511 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,820 @@
+2012-08-10  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Introduce JavaScriptVariant object.
+        https://bugs.webkit.org/show_bug.cgi?id=93644
+
+        The JavaScriptVariant can be used for functions that return results from
+        JavaScript such as executeJavaScript or functions that take arguments
+        to pass a variable to JavaScript and they want to make sure the type
+        is correct.
+
+        Convert executeJavaScriptFunction() to use this data type as the
+        example, other functions will be converted in the future.
+
+        PR 14929
+
+        Internally reviewed by Joe Mason
+        Reviewed by Adam Treat
+
+        * Api/JavaScriptVariant.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::JSValueRefToBlackBerryJavaScriptVariant):
+        (BlackBerry::WebKit::BlackBerryJavaScriptVariantToJSValueRef):
+        (BlackBerry::WebKit::JavaScriptVariant::JavaScriptVariant):
+        (BlackBerry::WebKit::JavaScriptVariant::~JavaScriptVariant):
+        (BlackBerry::WebKit::JavaScriptVariant::operator=):
+        (BlackBerry::WebKit::JavaScriptVariant::setType):
+        (BlackBerry::WebKit::JavaScriptVariant::type):
+        (BlackBerry::WebKit::JavaScriptVariant::setDouble):
+        (BlackBerry::WebKit::JavaScriptVariant::doubleValue):
+        (BlackBerry::WebKit::JavaScriptVariant::setString):
+        (BlackBerry::WebKit::JavaScriptVariant::stringValue):
+        (BlackBerry::WebKit::JavaScriptVariant::setBoolean):
+        (BlackBerry::WebKit::JavaScriptVariant::booleanValue):
+        * Api/JavaScriptVariant.h: Added.
+        (WebKit):
+        * Api/JavaScriptVariant_p.h: Added.
+        (WebKit):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::executeJavaScriptFunction):
+        * Api/WebPage.h:
+
+2012-08-09  Leo Yang  <leoyang@rim.com>
+
+        [BlackBerry] Export InRegionScroller to fix build
+        https://bugs.webkit.org/show_bug.cgi?id=93635
+
+        Reviewed by Antonio Gomes.
+
+        Build fix.
+
+        * Api/InRegionScroller.h:
+
+2012-08-08  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Implement about:memory-live
+        https://bugs.webkit.org/show_bug.cgi?id=93153
+
+        Reviewed by Yong Li.
+        Patch by Jacky Jiang  <zhajiang@rim.com>
+
+        Implementing about:memory-live to track memory peaks:
+        - about:memory-live/start: start tracking memory peaks.
+        - about:memory-live: show memory peaks every 30ms.
+        - about:memory-live/stop: stop tracking and show memory peaks.
+
+        Mainly track the following memory peaks:
+        - Total used memory (malloc + JSC).
+        - Total committed memory.
+        - Total mapped memory.
+
+        Add total committed memory for about:memory
+
+        * WebKitSupport/AboutData.cpp:
+        (BlackBerry::WebKit::memoryPage):
+        (WebKit):
+        (MemoryTracker):
+        (BlackBerry::WebKit::MemoryTracker::isActive):
+        (BlackBerry::WebKit::MemoryTracker::clear):
+        (BlackBerry::WebKit::MemoryTracker::peakTotalUsedMemory):
+        (BlackBerry::WebKit::MemoryTracker::peakTotalCommittedMemory):
+        (BlackBerry::WebKit::MemoryTracker::peakTotalMappedMemory):
+        (BlackBerry::WebKit::MemoryTracker::MemoryTracker):
+        (BlackBerry::WebKit::MemoryTracker::instance):
+        (BlackBerry::WebKit::MemoryTracker::start):
+        (BlackBerry::WebKit::MemoryTracker::stop):
+        (BlackBerry::WebKit::MemoryTracker::updateMemoryPeaks):
+        (BlackBerry::WebKit::memoryPeaksToHtmlTable):
+        (BlackBerry::WebKit::memoryLivePage):
+        (BlackBerry::WebKit::aboutData):
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Tie up the scrolling machinery to the graphics tree when applicable for in-region scroll
+        https://bugs.webkit.org/show_bug.cgi?id=93482
+        PR #187672
+        Make InRegionScroller a simple public webkit/ API
+        PR #188677
+
+        Reviewed by Rob Buis.
+
+        In order to prepare InRegionScroller to be a public API
+        in webkit/, the patch:
+
+        1) Renamed the current InRegionScroller class to InRegionScrollerPrivate;
+        2) Moved InRegionScroller.cpp|h from WebKitSupport/ to Api/;
+        3) Renamed InRegionScroller.h to InRegionScroller_p.h;
+        4) Added a new public class implementation to InRegionScroller.h;
+        5) Adapted WebPage and TouchEventHandler classes to use InRegionScroller::d directly.
+
+        The most important API here is '::compositedSetScrollPosition'
+
+        It is a  UI/Compositing thread method only and sets the associated LayerCompositingThread
+        (camouflaged as a unsigned) for each created InRegionScrollableArea that supports
+        composited scrolling.
+
+        The way ::compositedSetScrollPosition "scrolls" a layer is by setting the boundsOrigin
+        property to the LayerCompositingThread's 'override' property in the UI/Compositing thread.
+
+        * Api/InRegionScroller.cpp: Renamed from Source/WebKit/blackberry/WebKitSupport/InRegionScroller.cpp.
+        (WebKit):
+        (BlackBerry::WebKit::InRegionScroller::InRegionScroller):
+        (BlackBerry::WebKit::InRegionScroller::~InRegionScroller):
+        (BlackBerry::WebKit::InRegionScroller::compositedSetScrollPosition):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::InRegionScrollerPrivate):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::setNode):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::node):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::reset):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::hasNode):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::canScroll):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::compositedSetScrollPosition):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::scrollBy):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::inRegionScrollableAreasForPoint):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::scrollNodeRecursively):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::scrollRenderer):
+        (BlackBerry::WebKit::InRegionScrollerPrivate::adjustScrollDelta):
+        (BlackBerry::WebKit::canScrollInnerFrame):
+        (BlackBerry::WebKit::canScrollRenderBox):
+        (BlackBerry::WebKit::parentLayer):
+        (BlackBerry::WebKit::enclosingLayerNode):
+        (BlackBerry::WebKit::isNonRenderViewFixedPositionedContainer):
+        (BlackBerry::WebKit::pushBackInRegionScrollable):
+        * Api/InRegionScroller.h: Copied from Source/WebKit/blackberry/WebKitSupport/InRegionScroller.h.
+        (WebKit):
+        (InRegionScroller):
+        * Api/InRegionScroller_p.h: Renamed from Source/WebKit/blackberry/WebKitSupport/InRegionScroller.h.
+        (WebCore):
+        (WebKit):
+        (InRegionScrollerPrivate):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::scrollBy):
+        (BlackBerry::WebKit::WebPagePrivate::notifyInRegionScrollStatusChanged):
+        (BlackBerry::WebKit::WebPagePrivate::clearDocumentData):
+        (BlackBerry::WebKit::WebPagePrivate::setScrollOriginPoint):
+        (BlackBerry::WebKit::WebPage::inRegionScroller):
+        (WebKit):
+        * Api/WebPage.h:
+        (WebKit):
+        * WebKitSupport/InRegionScrollableArea.cpp:
+        (BlackBerry::WebKit::InRegionScrollableArea::InRegionScrollableArea):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::drawTapHighlight):
+
+2012-08-08  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Make WebOverlayPrivate::scheduleCompositingRun a WebPagePrivate method.
+        https://bugs.webkit.org/show_bug.cgi?id=93480
+        PR #188682
+
+        Reviewed by Rob Buis.
+
+        ... this way it can be used by others.
+
+        No behavioural change. Another preparation patch.
+
+        * Api/WebOverlay.cpp:
+        (BlackBerry::WebKit::WebOverlayPrivate::scheduleCompositingRun):
+        * Api/WebPage.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::scheduleCompositingRun):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-08-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124887.
+        http://trac.webkit.org/changeset/124887
+        https://bugs.webkit.org/show_bug.cgi?id=93504
+
+        Dependent API being removed. (Requested by mfenton on
+        #webkit).
+
+        * Api/WebPageClient.h:
+        * WebKitSupport/InputHandler.cpp:
+        * WebKitSupport/InputHandler.h:
+        (InputHandler):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+        (BlackBerry::WebKit::TouchEventHandler::spellCheck):
+        (WebKit):
+        * WebKitSupport/TouchEventHandler.h:
+        (TouchEventHandler):
+
+2012-08-08  Ed Baker  <edbaker@rim.com>
+
+        [BlackBerry] Add relayout after updating fixed reported size
+        https://bugs.webkit.org/show_bug.cgi?id=93116
+        PR #160059
+        
+        Reviewed by Antonio Gomes.
+        
+        Reviewed internally by Antonio Gomes.
+
+        On an orientation change and after fixed reported size is
+        updated perform a layout and update the fixed elements after
+        scrolling. This will recalculate the height and width of
+        fixed position elements using percentage values with the
+        new fixed reported size. Otherwise using the old fixed reported
+        size in the new orientation overflowing or clipping could occur.
+        
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+
+2012-08-07  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] always set PolicyAction to PolicyIgnore if the chrome returns false for acceptNavigationRequest
+        https://bugs.webkit.org/show_bug.cgi?id=93251
+
+        Reviewed by George Staikos.
+
+        In acceptNavigationRequest(), webkit will ask if the chrome will accept the navigation request.
+        We will take this chance to see if the request is an internal-webkit protocol, otherwise,
+        we will try to launch an external application to handle the request, and ask webkit to ignore
+        the request by returning false in acceptNavigationRequest().
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDecidePolicyForNavigationAction):
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Change how devicePixelRatio is set.
+        https://bugs.webkit.org/show_bug.cgi?id=93385
+
+        Reviewed by Antonio Gomes.
+
+        Change devicePixelRatio to be set immediately after the page is created based
+        on the WebSetting.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::recomputeVirtualViewportFromViewportArguments):
+
+2012-08-07  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] [FullScreen] No need to scroll 'x' to 0 before entering fullscreen
+        https://bugs.webkit.org/show_bug.cgi?id=91750
+        PR #178293
+
+        Reviewed by Rob Buis.
+
+        We are not adjusting the 'left' CSS property of the fullscreen wrapper
+        properly, so no need to scroll 'x' to 0 anymore.
+
+        Internally reviewed by Jacky Jiang.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::enterFullScreenForElement):
+
+2012-08-07  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry][FullScreen] Remove the set/reset of touch modes code when entering/leaving fullscreen
+        https://bugs.webkit.org/show_bug.cgi?id=92520
+        PR #184511
+
+        Reviewed by Yong Li.
+        Internally reviewed by Gen Mak.
+
+        Remove touch mode set/reset when entering/leaving fullscreen
+        for media elements through the new FULLSCREEN_API code path.
+        The client now handles it.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::enterFullScreenForElement):
+        (BlackBerry::WebKit::WebPagePrivate::exitFullScreenForElement):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Add missing include in FrameLoaderClienBlackBerry after Base64 moved.
+        https://bugs.webkit.org/show_bug.cgi?id=93383
+
+        Reviewed by Rob Buis.
+
+        Base64 moved from platform/text to wtf/text, need to add mssing
+        include.
+
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+
+2012-08-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] InspectorOverlay class duplicated in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=93124
+
+        Reviewed by Rob Buis.
+
+        Moved files to better align with namespace names.
+
+        * WebKitSupport/InspectorOverlay.cpp: Renamed from Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.cpp.
+        (WebKit):
+        (BlackBerry::WebKit::InspectorOverlay::create):
+        (BlackBerry::WebKit::InspectorOverlay::InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::notifySyncRequired):
+        (BlackBerry::WebKit::InspectorOverlay::paintContents):
+        (BlackBerry::WebKit::InspectorOverlay::showDebugBorders):
+        (BlackBerry::WebKit::InspectorOverlay::showRepaintCounter):
+        (BlackBerry::WebKit::InspectorOverlay::~InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::clear):
+        (BlackBerry::WebKit::InspectorOverlay::update):
+        * WebKitSupport/InspectorOverlay.h: Renamed from Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.h.
+        (WebCore):
+        (WebKit):
+        (InspectorOverlay):
+        (InspectorOverlayClient):
+        (BlackBerry::WebKit::InspectorOverlay::setClient):
+        (BlackBerry::WebKit::InspectorOverlay::notifyAnimationStarted):
+
+2012-08-07  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Update API for spell checking suggestions.
+        https://bugs.webkit.org/show_bug.cgi?id=93356
+
+        Reviewed by Antonio Gomes.
+
+        PR 163283.
+
+        Add connections for updated spell checking options request API.  Move
+        all this logic into InputHandler.
+
+        Reviewed Internally by Gen Mak and Nima Ghanavatian.
+
+        * Api/WebPageClient.h:
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::shouldRequestSpellCheckingOptionsForPoint):
+        (WebKit):
+        (BlackBerry::WebKit::InputHandler::requestSpellingCheckingOptions):
+        * WebKitSupport/InputHandler.h:
+        (Platform):
+        (InputHandler):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::handleTouchPoint):
+        * WebKitSupport/TouchEventHandler.h:
+        (TouchEventHandler):
+
+2012-08-06  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] About: shows PAGE_CACHE not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=93216
+
+        Reviewed by Antonio Gomes.
+
+        Page cache is a feature that can be enabled/disabled at runtime, there's no
+        MACRO named PAGE_CACHE to control the feature.
+
+        * WebCoreSupport/AboutDataEnableFeatures.in:
+
+2012-08-03  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] FrameLoaderClient::restoreViewState() shouldn't trigger painting
+        https://bugs.webkit.org/show_bug.cgi?id=93141
+
+        Reviewed by Rob Buis.
+
+        PR# 172041.
+        It is not always safe to render the page at this point. So we post a message
+        instead.
+
+        * Api/WebPage.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::restoreHistoryViewState):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::restoreViewState):
+
+2012-08-03  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] InspectorOverlay class duplicated in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=93124
+
+        Reviewed by Rob Buis.
+
+        Changed namespace of InspectorOverlay from WebCore to
+        BlackBerry::WebKit
+
+        * Api/WebPage.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::setInspectorOverlayClient):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/InspectorClientBlackBerry.h:
+        * WebCoreSupport/InspectorOverlay.cpp:
+        (BlackBerry::WebKit::InspectorOverlay::create):
+        (BlackBerry::WebKit::InspectorOverlay::InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::notifySyncRequired):
+        (BlackBerry::WebKit::InspectorOverlay::paintContents):
+        (BlackBerry::WebKit::InspectorOverlay::showDebugBorders):
+        (BlackBerry::WebKit::InspectorOverlay::showRepaintCounter):
+        (BlackBerry::WebKit::InspectorOverlay::contentsVisible):
+        (BlackBerry::WebKit::InspectorOverlay::update):
+        * WebCoreSupport/InspectorOverlay.h:
+        (WebKit):
+        (InspectorOverlayClient):
+        (InspectorOverlay):
+        (BlackBerry::WebKit::InspectorOverlay::notifyAnimationStarted):
+
+2012-08-03  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Overlays display checkerboard that doesn't resolve
+        https://bugs.webkit.org/show_bug.cgi?id=93099
+
+        Reviewed by Antonio Gomes.
+
+        The WebKit-thread overlays, like tap highlight, inspector highlight and
+        selection are all part of a separate graphics layer tree rooted in
+        WebPagePrivate::m_overlayLayer.
+
+        When LayerRenderer needs to schedule a commit to reactively render
+        tiles and resolve checkerboard, it does so through the root layer.
+        Since the overlay layer root didn't have a GraphicsLayerClient, there
+        was no implementation of GraphicsLayerClient::notifySyncRequired() to
+        call, and a commit was never scheduled, thus checkerboard never
+        resolved.
+
+        Fixed by adding a fallback implementation of GraphicsLayerClient in
+        WebPagePrivate and hooking up the overlay root to it. Also, this
+        implementation can be shared by the various overlays to avoide code
+        duplication, specifically to implement notifySyncRequired(),
+        showDebugBorders() and showRepaintCounter() only once.
+
+        Fixing this revealed a bug where the web page would get stuck in an
+        endless sequence of commits. It turned out that
+        WebPagePrivate::updateDelegatedOverlays() was called right in the
+        middle of the commit operation, after performing the webkit thread part
+        of the commit operation but before we continued on the compositing
+        thread. Since updateDelegatedOverlays() typically mutates layers, this
+        is very bad (layers should not be mutated mid-commit). The mutations
+        also cause a new commit to scheduled from within the current, which
+        results in an endless sequence of commits.
+
+        Fixed this latter bug by moving the updateDelegatedOverlays() call to
+        the beginning of the method where it can cause no harm. This is before
+        we mark the web page as no longer needing commit, so even if the
+        implementation flips the "needs commit" bit, we will immediately flip
+        it back and proceed with commit as usual.
+
+        PR 187458, 184377
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::overlayLayer):
+        (BlackBerry::WebKit::WebPagePrivate::commitRootLayerIfNeeded):
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::notifySyncRequired):
+        (BlackBerry::WebKit::WebPagePrivate::showDebugBorders):
+        (BlackBerry::WebKit::WebPagePrivate::showRepaintCounter):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::notifyAnimationStarted):
+        (BlackBerry::WebKit::WebPagePrivate::paintContents):
+        * WebCoreSupport/InspectorOverlay.cpp:
+        (WebCore::InspectorOverlay::notifySyncRequired):
+        (WebCore::InspectorOverlay::showDebugBorders):
+        (WebCore::InspectorOverlay::showRepaintCounter):
+        * WebKitSupport/DefaultTapHighlight.cpp:
+        (BlackBerry::WebKit::DefaultTapHighlight::notifySyncRequired):
+        (BlackBerry::WebKit::DefaultTapHighlight::showDebugBorders):
+        (WebKit):
+        (BlackBerry::WebKit::DefaultTapHighlight::showRepaintCounter):
+        * WebKitSupport/DefaultTapHighlight.h:
+        (DefaultTapHighlight):
+        * WebKitSupport/SelectionOverlay.cpp:
+        (BlackBerry::WebKit::SelectionOverlay::notifySyncRequired):
+        (BlackBerry::WebKit::SelectionOverlay::showDebugBorders):
+        (WebKit):
+        (BlackBerry::WebKit::SelectionOverlay::showRepaintCounter):
+        * WebKitSupport/SelectionOverlay.h:
+        (SelectionOverlay):
+
+2012-08-02  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Add default implementation of GraphicsLayerClient::contentsVisible()
+        https://bugs.webkit.org/show_bug.cgi?id=93036
+
+        Reviewed by George Staikos.
+
+        Remove implementation of GraphicsLayerClient::contentsVisible() now
+        that it has a default implementation.
+
+        This also fixes a bug where memory usage for the inspector highlight
+        overlay would balloon because it returned true from contentsVisible()
+        which would cause the LayerTiler to populate all tiles. The default
+        implementation returns false instead.
+
+        PR 187458, 184377
+
+        * WebCoreSupport/InspectorOverlay.cpp:
+        (WebCore::InspectorOverlay::showRepaintCounter):
+        * WebCoreSupport/InspectorOverlay.h:
+        (InspectorOverlay):
+        * WebKitSupport/DefaultTapHighlight.h:
+        * WebKitSupport/SelectionOverlay.h:
+
+2012-08-02  Antonio Gomes  <agomes@rim.com>
+
+        Unreviewed debug build fix (bug 92889)
+
+        * WebKitSupport/InRegionScroller.cpp:
+        (BlackBerry::WebKit::pushBackInRegionScrollable):
+
+2012-08-02  Leo Yang  <leoyang@rim.com>
+
+        [BlackBerry] Rounding error of destination rect of checkerboard
+        https://bugs.webkit.org/show_bug.cgi?id=93012
+
+        Reviewed by Rob Buis.
+
+        Reviewed internally by Jakob Petsovits.
+
+        Intersect with the destination rectangle to eliminate the rounding error.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::blitContents):
+
+2012-08-01  Antonio Gomes  <agomes@rim.com>
+
+        [BlackBerry] Implement InRegionScroller class as a in-region scroll controller
+        https://bugs.webkit.org/show_bug.cgi?id=92889
+        PR #186587
+
+        Reviewed by Yong Li.
+
+        Internally reviewed by Arvid Nilsson.
+
+        Moved all in-region scrolling code out of WebPagePrivate to the just
+        created InRegionScroller class. This class aims to:
+
+        1) Centralize all in-region scroll code and clean up WebPagePrivate as a consequence.
+        2) Be the bases to add UI/Compositing thread driven scrolls to in-region.
+
+        The patch does not change any functionallity change.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::scrollBy):
+        (BlackBerry::WebKit::WebPagePrivate::notifyInRegionScrollStatusChanged):
+        (BlackBerry::WebKit::WebPagePrivate::clearDocumentData):
+        (BlackBerry::WebKit::WebPagePrivate::setScrollOriginPoint):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebKitSupport/InRegionScrollableArea.cpp:
+        (BlackBerry::WebKit::InRegionScrollableArea::layer):
+        * WebKitSupport/InRegionScroller.cpp: Added.
+        (WebKit):
+        (BlackBerry::WebKit::canScrollInnerFrame):
+        (BlackBerry::WebKit::canScrollRenderBox):
+        (BlackBerry::WebKit::parentLayer):
+        (BlackBerry::WebKit::enclosingLayerNode):
+        (BlackBerry::WebKit::isNonRenderViewFixedPositionedContainer):
+        (BlackBerry::WebKit::pushBackInRegionScrollable):
+        (BlackBerry::WebKit::InRegionScroller::InRegionScroller):
+        (BlackBerry::WebKit::InRegionScroller::setNode):
+        (BlackBerry::WebKit::InRegionScroller::node):
+        (BlackBerry::WebKit::InRegionScroller::reset):
+        (BlackBerry::WebKit::InRegionScroller::isNull):
+        (BlackBerry::WebKit::InRegionScroller::scrollBy):
+        (BlackBerry::WebKit::InRegionScroller::inRegionScrollableAreasForPoint):
+        (BlackBerry::WebKit::InRegionScroller::scrollNodeRecursively):
+        (BlackBerry::WebKit::InRegionScroller::scrollRenderer):
+        (BlackBerry::WebKit::InRegionScroller::adjustScrollDelta):
+        * WebKitSupport/InRegionScroller.h: Added.
+        (WebCore):
+        (WebKit):
+        (InRegionScroller):
+        * WebKitSupport/TouchEventHandler.cpp:
+        (BlackBerry::WebKit::TouchEventHandler::drawTapHighlight):
+
+2012-08-01  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Favicon should be Base64 encoded for cross-process passing
+        https://bugs.webkit.org/show_bug.cgi?id=92857
+
+        Reviewed by George Staikos.
+
+        The current implementation just passes the internal of SkPixels data to the client,
+        which can't be passed accross the process boundary to chrome for processing.
+        This patch makes the favicon Base64 encoded so that can be passed to chrome in another process.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/FrameLoaderClientBlackBerry.cpp:
+        (WebCore::FrameLoaderClientBlackBerry::dispatchDidReceiveIcon):
+
+2012-08-01  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Allow client side to add and remove origin access whitelist entries
+        https://bugs.webkit.org/show_bug.cgi?id=92790
+
+        Reviewed by Yong Li.
+
+        PR: 172658
+        Add two new APIs to add and remove origin access whitelist entries.
+        Initialize the BlackBerryAllowCrossSiteRequests WebSetting to false.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::addOriginAccessWhitelistEntry):
+        (WebKit):
+        (BlackBerry::WebKit::WebPage::addOriginAccessWhitelistEntry):
+        (BlackBerry::WebKit::WebPagePrivate::removeOriginAccessWhitelistEntry):
+        (BlackBerry::WebKit::WebPage::removeOriginAccessWhitelistEntry):
+        * Api/WebPage.h:
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * Api/WebSettings.cpp:
+        (BlackBerry::WebKit::WebSettings::standardSettings):
+
+2012-08-01  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Consolidate suppression of keyboard requests.
+        https://bugs.webkit.org/show_bug.cgi?id=92871
+
+        Reviewed by Antonio Gomes.
+
+        Reduce VKB requests even more by applying the filter on
+        all requests during processing.
+
+        Reviewed Internally by Gen Mak.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::focusedNodeChanged):
+        (BlackBerry::WebKit::InputHandler::notifyClientOfKeyboardVisibilityChange):
+
+2012-08-01  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Disable tap highlight when transparent color is specified
+        https://bugs.webkit.org/show_bug.cgi?id=92849
+
+        Reviewed by Antonio Gomes.
+
+        When the web page specifies -webkit-tap-highlight-color:rgba(0,0,0,0)
+        or any color with alpha value 0, we should disable the tap highlight.
+
+        * WebKitSupport/DefaultTapHighlight.cpp:
+        (BlackBerry::WebKit::DefaultTapHighlight::draw):
+
+2012-07-31  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Pass all file chooser settings to clients
+        https://bugs.webkit.org/show_bug.cgi?id=92237
+
+        Reviewed by Rob Buis.
+
+        Expose all file chooser settings to clients.
+
+        * Api/WebPageClient.h:
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::runOpenPanel):
+
+2012-07-31  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Fix crash in InputHandler spell checking.
+        https://bugs.webkit.org/show_bug.cgi?id=92763
+
+        Reviewed by Antonio Gomes.
+
+        PR 185574.
+
+        Fix crash in getSpellChecker by guarding the calling paths
+        to ensure that m_currentFocusElement is valid.
+
+        Also add ASSERTs for previous crash.
+
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::spellCheckingRequestProcessed):
+        (BlackBerry::WebKit::InputHandler::spellCheckingRequestCancelled):
+        (BlackBerry::WebKit::InputHandler::getSpellChecker):
+
+2012-07-31  Genevieve Mak  <gmak@rim.com>
+
+        Send an onContextMenu event to the page content
+        so that context menus can be prevented. We use
+        the node's event handler because we want to use
+        the fat finger's node. If we use  the EventHandler's
+        sendContextMenuEvent it will hit test with the mouse
+        position which may not be what we want.
+        PR #184032
+        https://bugs.webkit.org/show_bug.cgi?id=92766
+
+        Reviewed by Antonio Gomes.
+        Reviewed Internally by Antonio Gomes.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::webContext):
+        (BlackBerry::WebKit::WebPagePrivate::contextNode):
+
+2012-07-31  Arvid Nilsson  <anilsson@rim.com>
+
+        [BlackBerry] Backing store output flickers when using WebPageCompositor
+        https://bugs.webkit.org/show_bug.cgi?id=90291
+
+        Reviewed by Antonio Gomes.
+
+        The backing store doesn't know when the API client swaps the buffers,
+        so it doesn't know when to signal the blit generation condition
+        variable. Fixed by using EGL fence sync instead, when available, so we
+        don't have to know.
+
+        Reviewed internally by Filip Spacek.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::~BackingStorePrivate):
+        (BlackBerry::WebKit::BackingStorePrivate::render):
+        (BlackBerry::WebKit::BackingStorePrivate::blitContents):
+        (BlackBerry::WebKit::BackingStorePrivate::compositeContents):
+        * Api/BackingStore_p.h:
+        (BackingStorePrivate):
+        * WebKitSupport/BackingStoreTile.cpp:
+        (BlackBerry::WebKit::TileBuffer::TileBuffer):
+        * WebKitSupport/BackingStoreTile.h:
+        (BlackBerry::WebKit::TileBuffer::syncObject):
+        (BlackBerry::WebKit::TileBuffer::setSyncObject):
+        (TileBuffer):
+        * WebKitSupport/SurfacePool.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::SurfacePool::SurfacePool):
+        (BlackBerry::WebKit::SurfacePool::initialize):
+        (BlackBerry::WebKit::SurfacePool::waitForBuffer):
+        (BlackBerry::WebKit::SurfacePool::notifyBuffersComposited):
+        * WebKitSupport/SurfacePool.h:
+        (SurfacePool):
+
+2012-07-30  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Get rid of Element::isReadOnlyFormControl other than CSS related
+        https://bugs.webkit.org/show_bug.cgi?id=92612
+
+        Reviewed by Kent Tamura.
+
+        This patch replaces Element::isReadOnlyFormControl() to
+        HTMLFormControlElement::readOnly() for preparation of introducing
+        Element::shouldMatchReadWriteSelector(), bug 92602.
+
+        * WebKitSupport/DOMSupport.cpp:
+        (BlackBerry::WebKit::DOMSupport::isTextBasedContentEditableElement): Replaced isReadOnlyFormControl() by HTMLTextFormControlElement::readOnly().
+
+2012-07-30  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Optimize the generation of selection details generation.
+        https://bugs.webkit.org/show_bug.cgi?id=92522
+
+        Reviewed by Antonio Gomes.
+
+        PR 179264.
+
+        Reduce the number of times we generate selection details notifications.
+
+        This removes several notifications that are handled by the standard
+        notification path and makes skipping duplicate notifications the default
+        so that only those that must generate a response do.
+
+        Reviewed Internally by Gen Mak.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::notifyTransformedContentsSizeChanged):
+        (BlackBerry::WebKit::WebPagePrivate::updateDelegatedOverlays):
+        * WebKitSupport/InputHandler.cpp:
+        (BlackBerry::WebKit::InputHandler::setElementUnfocused):
+        * WebKitSupport/SelectionHandler.cpp:
+        (BlackBerry::WebKit::SelectionHandler::setCaretPosition):
+        (BlackBerry::WebKit::SelectionHandler::updateOrHandleInputSelection):
+        (BlackBerry::WebKit::SelectionHandler::setSelection):
+        (BlackBerry::WebKit::SelectionHandler::selectionPositionChanged):
+        * WebKitSupport/SelectionHandler.h:
+        (SelectionHandler):
+
+2012-07-30  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Adapt to changes in the SharedArray platform API
+        https://bugs.webkit.org/show_bug.cgi?id=92631
+
+        Reviewed by Rob Buis.
+
+        Adapt to changes in the SharedArray platform API. No behavioural change.
+
+        Reviewed internally by Joe Mason.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::getBackForwardList):
+        * Api/WebPage.h:
+        * Api/WebPageClient.h:
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::runOpenPanel):
+
+2012-07-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Replace UnicodeWinCE with UnicodeWchar
+        https://bugs.webkit.org/show_bug.cgi?id=92539
+
+        Reviewed by Ryosuke Niwa.
+
+        UnicodeWinCE never contained WinCE specific code. UnicodeWchar
+        is a replacement for it, which is mainly based on the functions
+        from <wchar.h>. It is ment as a minimal Unicode backend, which
+        can be used very easy and has no external dependencies.
+
+        * WebCoreSupport/AboutDataUseFeatures.in:
+
 2012-07-27  Eli Fidler  <efidler@rim.com>
 
         [BlackBerry] Adapt to change in the FontInfo platform API.
diff --git a/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in b/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in
index 1c1fa37ff..9319c0001 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in
+++ b/Source/WebKit/blackberry/WebCoreSupport/AboutDataEnableFeatures.in
@@ -134,7 +134,6 @@ OPCODE_STATS
 ORIENTATION_EVENTS
 OSR_ENTRY
 OVERFLOW_SCROLLING
-PAGE_CACHE
 PAGE_POPUP
 PAGE_VISIBILITY_API
 PAN_SCROLLING
diff --git a/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in b/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
index 66f957519..ee6a3df2b 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
+++ b/Source/WebKit/blackberry/WebCoreSupport/AboutDataUseFeatures.in
@@ -111,7 +111,7 @@ WEBAUDIO_IPP
 WEBAUDIO_MKL
 WEBKIT_IMAGE_DECODERS
 WEBP
-WINCE_UNICODE
+WCHAR_UNICODE
 WININET
 WK_SCROLLBAR_PAINTER
 WTFURL
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
index 2b7c8f992..b0dae6097 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -507,26 +507,36 @@ void ChromeClientBlackBerry::exceededDatabaseQuota(Frame* frame, const String& n
 void ChromeClientBlackBerry::runOpenPanel(Frame*, PassRefPtr<FileChooser> chooser)
 {
     SharedArray<WebString> initialFiles;
-    unsigned int initialFileSize = chooser->settings().selectedFiles.size();
-    if (initialFileSize > 0)
-        initialFiles.reset(new WebString[initialFileSize]);
-    for (unsigned i = 0; i < initialFileSize; ++i)
+    unsigned numberOfInitialFiles = chooser->settings().selectedFiles.size();
+    if (numberOfInitialFiles > 0)
+        initialFiles.reset(new WebString[numberOfInitialFiles], numberOfInitialFiles);
+    for (unsigned i = 0; i < numberOfInitialFiles; ++i)
         initialFiles[i] = chooser->settings().selectedFiles[i];
 
+    SharedArray<WebString> acceptMIMETypes;
+    unsigned numberOfTypes = chooser->settings().acceptMIMETypes.size();
+    if (numberOfTypes > 0)
+        acceptMIMETypes.reset(new WebString[numberOfTypes], numberOfTypes);
+    for (unsigned i = 0; i < numberOfTypes; ++i)
+        acceptMIMETypes[i] = chooser->settings().acceptMIMETypes[i];
+
+    WebString capture;
+#if ENABLE(MEDIA_CAPTURE)
+    capture = chooser->settings().capture;
+#endif
+
     SharedArray<WebString> chosenFiles;
-    unsigned int chosenFileSize;
 
     {
         PageGroupLoadDeferrer deferrer(m_webPagePrivate->m_page, true);
         TimerBase::fireTimersInNestedEventLoop();
 
-        // FIXME: Use chooser->settings().acceptMIMETypes instead of WebString() for the second parameter.
-        if (!m_webPagePrivate->m_client->chooseFilenames(chooser->settings().allowsMultipleFiles, WebString(), initialFiles, initialFileSize, chosenFiles, chosenFileSize))
+        if (!m_webPagePrivate->m_client->chooseFilenames(chooser->settings().allowsMultipleFiles, acceptMIMETypes, initialFiles, capture, chosenFiles))
             return;
     }
 
-    Vector<String> files(chosenFileSize);
-    for (unsigned i = 0; i < chosenFileSize; ++i)
+    Vector<String> files(chosenFiles.length());
+    for (unsigned i = 0; i < chosenFiles.length(); ++i)
         files[i] = chosenFiles[i];
     chooser->chooseFiles(files);
 }
diff --git a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
index cf22ab6ad..90ee06964 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/FrameLoaderClientBlackBerry.cpp
@@ -58,6 +58,9 @@
 #include "ProtectionSpace.h"
 #include "ScopePointer.h"
 #include "SharedBuffer.h"
+#include "SkData.h"
+#include "SkImageEncoder.h"
+#include "SkStream.h"
 #include "TextEncoding.h"
 #include "TouchEventHandler.h"
 #if ENABLE(WEBDOM)
@@ -65,12 +68,15 @@
 #endif
 #include "WebPageClient.h"
 
+#include <BlackBerryPlatformExecutableMessage.h>
 #include <BlackBerryPlatformLog.h>
 #include <BlackBerryPlatformMediaDocument.h>
+#include <BlackBerryPlatformMessageClient.h>
 #include <BlackBerryPlatformScreen.h>
 #include <JavaScriptCore/APICast.h>
 #include <network/FilterStream.h>
 #include <network/NetworkRequest.h>
+#include <wtf/text/Base64.h>
 
 using WTF::String;
 using namespace WebCore;
@@ -208,24 +214,23 @@ void FrameLoaderClientBlackBerry::dispatchDecidePolicyForNavigationAction(FrameP
         bool isFragmentScroll = url.hasFragmentIdentifier() && url != currentUrl && equalIgnoringFragmentIdentifier(currentUrl, url);
         decision = decidePolicyForExternalLoad(request, isFragmentScroll);
 
-        // Let the client have a chance to say whether this navigation should
-        // be ignored or not.
+        // Let the client have a chance to say whether this navigation should be ignored or not.
         NetworkRequest platformRequest;
         request.initializePlatformRequest(platformRequest, cookiesEnabled());
         if (platformRequest.getTargetType() == NetworkRequest::TargetIsUnknown)
             platformRequest.setTargetType(isMainFrame() ? NetworkRequest::TargetIsMainFrame : NetworkRequest::TargetIsSubframe);
 
-        if (isMainFrame() && !m_webPagePrivate->m_client->acceptNavigationRequest(
-            platformRequest, BlackBerry::Platform::NavigationType(action.type()))) {
-            if (action.type() == NavigationTypeFormSubmitted
-                || action.type() == NavigationTypeFormResubmitted)
-                m_frame->loader()->resetMultipleFormSubmissionProtection();
-
-            if (action.type() == NavigationTypeLinkClicked && url.hasFragmentIdentifier()) {
-                ResourceRequest emptyRequest;
-                m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
-            }
+        if (!m_webPagePrivate->m_client->acceptNavigationRequest(platformRequest, BlackBerry::Platform::NavigationType(action.type()))) {
             decision = PolicyIgnore;
+            if (isMainFrame()) {
+                if (action.type() == NavigationTypeFormSubmitted || action.type() == NavigationTypeFormResubmitted)
+                    m_frame->loader()->resetMultipleFormSubmissionProtection();
+
+                if (action.type() == NavigationTypeLinkClicked && url.hasFragmentIdentifier()) {
+                    ResourceRequest emptyRequest;
+                    m_frame->loader()->activeDocumentLoader()->setLastCheckedRequest(emptyRequest);
+                }
+            }
         }
     }
 
@@ -1082,28 +1087,10 @@ void FrameLoaderClientBlackBerry::restoreViewState()
     // When rotate happens, only zoom when previous page was zoomToFitScale, otherwise keep old scale.
     if (orientationChanged && viewState.isZoomToFitScale)
         scale = BlackBerry::Platform::Graphics::Screen::primaryScreen()->width() * scale / static_cast<double>(BlackBerry::Platform::Graphics::Screen::primaryScreen()->height());
-    m_webPagePrivate->m_backingStore->d->suspendScreenAndBackingStoreUpdates(); // don't flash checkerboard for the setScrollPosition call
-    m_frame->view()->setContentsSizeFromHistory(contentsSize);
-
-    // Here we need to set scroll position what we asked for.
-    // So we use ScrollView::setCanOverscroll(true).
-    bool oldCanOverscroll = m_frame->view()->canOverScroll();
-    m_frame->view()->setCanOverscroll(true);
-    m_webPagePrivate->setScrollPosition(scrollPosition);
-    m_frame->view()->setCanOverscroll(oldCanOverscroll);
-
-    m_webPagePrivate->m_shouldReflowBlock = viewState.shouldReflowBlock;
-
-    bool didZoom = m_webPagePrivate->zoomAboutPoint(scale, m_frame->view()->scrollPosition(), true /* enforceScaleClamping */, true /*forceRendering*/, true /*isRestoringZoomLevel*/);
-    // If we're already at that scale, then we should still force rendering
-    // since our scroll position changed.
-    m_webPagePrivate->m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::RenderAndBlit);
-
-    if (!didZoom) {
-        // We need to notify the client of the scroll position and content size change(s) above even if we didn't scale.
-        m_webPagePrivate->notifyTransformedContentsSizeChanged();
-        m_webPagePrivate->notifyTransformedScrollChanged();
-    }
+
+    // It is not safe to render the page at this point. So we post a message instead. Messages have higher priority than timers.
+    BlackBerry::Platform::webKitThreadMessageClient()->dispatchMessage(BlackBerry::Platform::createMethodCallMessage(
+        &WebPagePrivate::restoreHistoryViewState, m_webPagePrivate, contentsSize, scrollPosition, scale, viewState.shouldReflowBlock));
 }
 
 PolicyAction FrameLoaderClientBlackBerry::decidePolicyForExternalLoad(const ResourceRequest& request, bool isFragmentScroll)
@@ -1184,13 +1171,22 @@ void FrameLoaderClientBlackBerry::dispatchDidReceiveIcon()
 {
     String url = m_frame->document()->url().string();
     NativeImageSkia* bitmap = iconDatabase().synchronousNativeIconForPageURL(url, IntSize(10, 10));
-    if (!bitmap)
+    if (!bitmap || bitmap->bitmap().empty())
         return;
 
-    bitmap->lockPixels();
+    SkAutoLockPixels locker(bitmap->bitmap());
+    SkDynamicMemoryWStream writer;
+    if (!SkImageEncoder::EncodeStream(&writer, bitmap->bitmap(), SkImageEncoder::kPNG_Type, 100)) {
+        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelInfo, "Failed to convert the icon to PNG format.");
+        return;
+    }
+    SkData* data = writer.copyToData();
+    Vector<char> out;
+    base64Encode(static_cast<const char*>(data->data()), data->size(), out);
+    out.append('\0'); // Make it null-terminated.
     String iconUrl = iconDatabase().synchronousIconURLForPageURL(url);
-    m_webPagePrivate->m_client->setFavicon(img->width(), img->height(), (unsigned char*)bitmap->getPixels(), iconUrl.utf8().data());
-    bitmap->unlockPixels();
+    m_webPagePrivate->m_client->setFavicon(out.data(), iconUrl.utf8().data());
+    data->unref();
 }
 
 bool FrameLoaderClientBlackBerry::canCachePage() const
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
index e51631541..2af37526a 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
@@ -34,7 +34,7 @@ class WebPagePrivate;
 
 namespace WebCore {
 
-class InspectorClientBlackBerry : public InspectorClient, public InspectorFrontendChannel, public InspectorOverlay::InspectorOverlayClient {
+class InspectorClientBlackBerry : public InspectorClient, public InspectorFrontendChannel, public BlackBerry::WebKit::InspectorOverlay::InspectorOverlayClient {
 public:
     InspectorClientBlackBerry(BlackBerry::WebKit::WebPagePrivate*);
     virtual void inspectorDestroyed();
diff --git a/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp b/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
index 5f565c94b..1502e3db3 100644
--- a/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/AboutData.cpp
@@ -255,7 +255,9 @@ static String memoryPage()
 
     page += "<div class='box'><div class='box-title'>Process memory usage summary</div><table class='fixed-table'><col width=75%><col width=25%>";
 
-    page += numberToHTMLTr("Total memory usage (malloc + JSC)", mallocInfo.usmblks + mallocInfo.uordblks + jscMemoryStat.stackBytes + jscMemoryStat.JITBytes + mainHeap.capacity());
+    page += numberToHTMLTr("Total used memory (malloc + JSC)", mallocInfo.usmblks + mallocInfo.uordblks + jscMemoryStat.stackBytes + jscMemoryStat.JITBytes + mainHeap.capacity());
+
+    page += numberToHTMLTr("Total committed memory", BlackBerry::Platform::totalCommittedMemory());
 
     struct stat processInfo;
     if (!stat(String::format("/proc/%u/as", getpid()).latin1().data(), &processInfo))
@@ -307,6 +309,125 @@ static String memoryPage()
     return page;
 }
 
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
+class MemoryTracker {
+public:
+    static MemoryTracker& instance();
+    void start();
+    void stop();
+    bool isActive() const { return m_memoryTrackingTimer.isActive(); }
+    void clear() { m_peakTotalUsedMemory = 0; m_peakTotalCommittedMemory = 0; m_peakTotalMappedMemory = 0; }
+    void updateMemoryPeaks(Timer<MemoryTracker>*);
+    unsigned peakTotalUsedMemory() const { return m_peakTotalUsedMemory; }
+    unsigned peakTotalCommittedMemory() const {return m_peakTotalCommittedMemory; }
+    unsigned peakTotalMappedMemory() const { return m_peakTotalMappedMemory; }
+
+private:
+    MemoryTracker();
+    Timer<MemoryTracker> m_memoryTrackingTimer;
+    unsigned m_peakTotalUsedMemory;
+    unsigned m_peakTotalCommittedMemory;
+    unsigned m_peakTotalMappedMemory;
+};
+
+MemoryTracker::MemoryTracker()
+    : m_memoryTrackingTimer(this, &MemoryTracker::updateMemoryPeaks)
+    , m_peakTotalUsedMemory(0)
+    , m_peakTotalCommittedMemory(0)
+    , m_peakTotalMappedMemory(0)
+{
+}
+
+MemoryTracker& MemoryTracker::instance()
+{
+    DEFINE_STATIC_LOCAL(MemoryTracker, s_memoryTracker, ());
+    return s_memoryTracker;
+}
+
+void MemoryTracker::start()
+{
+    clear();
+    if (!m_memoryTrackingTimer.isActive())
+        m_memoryTrackingTimer.start(0, 0.01);
+}
+
+void MemoryTracker::stop()
+{
+    m_memoryTrackingTimer.stop();
+}
+
+void MemoryTracker::updateMemoryPeaks(Timer<MemoryTracker>*)
+{
+    // JS engine memory usage.
+    JSC::GlobalMemoryStatistics jscMemoryStat = JSC::globalMemoryStatistics();
+    JSC::Heap& mainHeap = JSDOMWindow::commonJSGlobalData()->heap;
+
+    // Malloc info.
+    struct mallinfo mallocInfo = mallinfo();
+
+    // Malloc and JSC memory.
+    unsigned totalUsedMemory = static_cast<unsigned>(mallocInfo.usmblks + mallocInfo.uordblks + jscMemoryStat.stackBytes + jscMemoryStat.JITBytes + mainHeap.capacity());
+    if (totalUsedMemory > m_peakTotalUsedMemory)
+        m_peakTotalUsedMemory = totalUsedMemory;
+
+    unsigned totalCommittedMemory = BlackBerry::Platform::totalCommittedMemory();
+    if (totalCommittedMemory > m_peakTotalCommittedMemory)
+        m_peakTotalCommittedMemory = totalCommittedMemory;
+
+    struct stat processInfo;
+    if (!stat(String::format("/proc/%u/as", getpid()).latin1().data(), &processInfo)) {
+        unsigned totalMappedMemory = static_cast<unsigned>(processInfo.st_size);
+        if (totalMappedMemory > m_peakTotalMappedMemory)
+            m_peakTotalMappedMemory = totalMappedMemory;
+    }
+}
+
+static String memoryPeaksToHtmlTable(MemoryTracker& memoryTracker)
+{
+    return String("<table class='fixed-table'><col width=75%><col width=25%>")
+        + numberToHTMLTr("Total used memory(malloc + JSC):", memoryTracker.peakTotalUsedMemory())
+        + numberToHTMLTr("Total committed memory:", memoryTracker.peakTotalCommittedMemory())
+        + numberToHTMLTr("Total mapped memory:", memoryTracker.peakTotalMappedMemory())
+        + "</table>";
+}
+
+static String memoryLivePage(String memoryLiveCommand)
+{
+    String page;
+
+    page = writeHeader("Memory Live Page")
+        + "<div class='box'><div class='box-title'>Memory Peaks</div>"
+        + "<div style='font-size:12px;color:#1BE0C9'>\"about:memory-live/start\": start tracking memory peaks.</div>"
+        + "<div style='font-size:12px;color:#1BE0C9'>\"about:memory-live\": show memory peaks every 30ms.</div>"
+        + "<div style='font-size:12px;color:#1BE0C9'>\"about:memory-live/stop\": stop tracking and show memory peaks.</div><br>";
+
+    MemoryTracker& memoryTracker = MemoryTracker::instance();
+    if (memoryLiveCommand.isEmpty()) {
+        if (!memoryTracker.isActive())
+            page += "<div style='font-size:15px;color:#E6F032'>Memory tracker isn't running, please use \"about:memory-live/start\" to start the tracker.</div>";
+        else {
+            page += memoryPeaksToHtmlTable(memoryTracker);
+            page += "<script type=\"text/javascript\">setInterval(function(){window.location.reload()},30);</script>";
+        }
+    } else if (equalIgnoringCase(memoryLiveCommand, "/start")) {
+        memoryTracker.start();
+        page += "<div style='font-size:15px;color:#E6F032'>Memory tracker is running.</div>";
+    } else if (equalIgnoringCase(memoryLiveCommand, "/stop")) {
+        if (!memoryTracker.isActive())
+            page += "<div style='font-size:15px;color:#E6F032'>Memory tracker isn't running.</div>";
+        else {
+            memoryTracker.stop();
+            page += memoryPeaksToHtmlTable(memoryTracker);
+            page += "<div style='font-size:15px;color:#E6F032'>Memory tracker is stopped.</div>";
+        }
+    } else
+        page += "<div style='font-size:15spx;color:#E6F032'>Unknown command! Please input a correct command!</div>";
+
+    page += "</div><br></div></body></html>";
+    return page;
+}
+#endif
+
 static String cachePage(String cacheCommand)
 {
     String result;
@@ -409,6 +530,9 @@ String aboutData(String aboutWhat)
 
     if (BlackBerry::Platform::debugSetting() > 0 && equalIgnoringCase(aboutWhat, "config"))
         return configPage();
+
+    if (aboutWhat.startsWith("memory-live"))
+        return memoryLivePage(aboutWhat.substring(11));
 #endif
 
     return String();
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
index a02f93a1c..0897df6f8 100644
--- a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.cpp
@@ -29,8 +29,8 @@ namespace WebKit {
 
 TileBuffer::TileBuffer(const Platform::IntSize& size)
     : m_size(size)
+    , m_syncObject(0)
     , m_buffer(0)
-    , m_blitGeneration(0)
 {
 }
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
index 7a0a42f5d..eb10809ea 100644
--- a/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
+++ b/Source/WebKit/blackberry/WebKitSupport/BackingStoreTile.h
@@ -47,14 +47,14 @@ class TileBuffer {
 
         Platform::Graphics::Buffer* nativeBuffer() const;
 
-        void setBlitGeneration(int g) const { m_blitGeneration = g; }
-        int blitGeneration() const { return m_blitGeneration; }
+        void* syncObject() const { return m_syncObject; }
+        void setSyncObject(void* syncObject) { m_syncObject = syncObject; }
 
     private:
         Platform::IntSize m_size;
         Platform::IntRectRegion m_renderedRegion;
+        void* m_syncObject;
         mutable Platform::Graphics::Buffer* m_buffer;
-        mutable int m_blitGeneration;
 };
 
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
index 2b54c337c..99411f01f 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DOMSupport.cpp
@@ -231,7 +231,10 @@ bool isTextBasedContentEditableElement(Element* element)
     if (!element)
         return false;
 
-    if (element->isReadOnlyFormControl() || !element->isEnabledFormControl())
+    if (element->isTextFormControl() && static_cast<HTMLTextFormControlElement*>(element)->readOnly())
+        return false;
+
+    if (!element->isEnabledFormControl())
         return false;
 
     if (isPopupInputField(element))
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
index 74c1bfae3..5b8eeb5b5 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.cpp
@@ -61,6 +61,12 @@ void DefaultTapHighlight::draw(const Platform::IntRectRegion& region, int red, i
     if (rect.isEmpty())
         return;
 
+    // Transparent color means disable the tap highlight.
+    if (!m_color.alpha()) {
+        hide();
+        return;
+    }
+
     {
         MutexLocker lock(m_mutex);
         m_visible = true;
@@ -104,9 +110,9 @@ void DefaultTapHighlight::hide()
         m_overlay->override()->addAnimation(fadeAnimation);
 }
 
-void DefaultTapHighlight::notifySyncRequired(const GraphicsLayer*)
+void DefaultTapHighlight::notifySyncRequired(const GraphicsLayer* layer)
 {
-    m_page->scheduleRootLayerCommit();
+    m_page->notifySyncRequired(layer);
 }
 
 void DefaultTapHighlight::paintContents(const GraphicsLayer*, GraphicsContext& c, GraphicsLayerPaintingPhase, const IntRect& /*inClip*/)
@@ -142,6 +148,16 @@ void DefaultTapHighlight::paintContents(const GraphicsLayer*, GraphicsContext& c
     c.restore();
 }
 
+bool DefaultTapHighlight::showDebugBorders(const GraphicsLayer* layer) const
+{
+    return m_page->showDebugBorders(layer);
+}
+
+bool DefaultTapHighlight::showRepaintCounter(const GraphicsLayer* layer) const
+{
+    return m_page->showRepaintCounter(layer);
+}
+
 } // namespace WebKit
 } // namespace BlackBerry
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
index 72ea40251..c04f6377c 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DefaultTapHighlight.h
@@ -56,10 +56,8 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const { return true; }
-
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
 private:
     DefaultTapHighlight(WebPagePrivate*);
diff --git a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
index f58cae891..d42059e6a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp
@@ -20,9 +20,11 @@
 #include "InRegionScrollableArea.h"
 
 #include "Frame.h"
-#include "NotImplemented.h"
+#include "LayerCompositingThread.h"
+#include "LayerWebKitThread.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
+#include "RenderLayerBacking.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "WebPage_p.h"
@@ -69,6 +71,8 @@ InRegionScrollableArea::InRegionScrollableArea(WebPagePrivate* webPage, RenderLa
         m_scrollsVertically = view->contentsHeight() > view->visibleHeight();
 
         m_overscrollLimitFactor = 0.0; // FIXME eventually support overscroll
+        m_cachedCompositedScrollableLayer = 0; // FIXME: Needs composited layer for inner frames.
+
     } else { // RenderBox-based elements case (scrollable boxes (div's, p's, textarea's, etc)).
 
         RenderBox* box = m_layer->renderBox();
@@ -83,7 +87,13 @@ InRegionScrollableArea::InRegionScrollableArea(WebPagePrivate* webPage, RenderLa
         m_scrollsHorizontally = box->scrollWidth() != box->clientWidth() && box->scrollsOverflowX();
         m_scrollsVertically = box->scrollHeight() != box->clientHeight() && box->scrollsOverflowY();
 
-        m_overscrollLimitFactor = 0.0; // FIXME eventually support overscroll
+        if (m_layer->usesCompositedScrolling()) {
+            m_supportsCompositedScrolling = true;
+            ASSERT(m_layer->backing()->hasScrollingLayer());
+            m_cachedCompositedScrollableLayer = reinterpret_cast<unsigned>(m_layer->backing()->scrollingLayer()->platformLayer()->layerCompositingThread());
+        }
+
+        m_overscrollLimitFactor = 0.0;
     }
 }
 
@@ -104,6 +114,6 @@ RenderLayer* InRegionScrollableArea::layer() const
     ASSERT(!m_isNull);
     return m_layer;
 }
-}
 
 }
+}
diff --git a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
index 3955752a8..37d5d30ad 100644
--- a/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InputHandler.cpp
@@ -362,8 +362,7 @@ void InputHandler::focusedNodeChanged()
     Node* node = frame->document()->focusedNode();
 
     if (isActiveTextEdit() && m_currentFocusElement == node) {
-        if (!processingChange())
-            notifyClientOfKeyboardVisibilityChange(true);
+        notifyClientOfKeyboardVisibilityChange(true);
         return;
     }
 
@@ -577,7 +576,7 @@ int32_t InputHandler::convertTransactionIdToSequenceId(int32_t transactionId)
 
 void InputHandler::spellCheckingRequestProcessed(int32_t transactionId, spannable_string_t* spannableString)
 {
-    if (!spannableString) {
+    if (!spannableString || !isActiveTextEdit()) {
         spellCheckingRequestCancelled(transactionId, false /* isSequenceId */);
         return;
     }
@@ -625,6 +624,9 @@ void InputHandler::spellCheckingRequestProcessed(int32_t transactionId, spannabl
 
 void InputHandler::spellCheckingRequestCancelled(int32_t id, bool isSequenceId)
 {
+    if (!isActiveTextEdit())
+        return;
+
     int32_t sequenceId = isSequenceId ? id : convertTransactionIdToSequenceId(id);
     SpellChecker* sp = getSpellChecker();
     if (!sp) {
@@ -636,6 +638,9 @@ void InputHandler::spellCheckingRequestCancelled(int32_t id, bool isSequenceId)
 
 SpellChecker* InputHandler::getSpellChecker()
 {
+    ASSERT(m_currentFocusElement);
+    ASSERT(m_currentFocusElement->document());
+
     if (Frame* frame = m_currentFocusElement->document()->frame())
         if (Editor* editor = frame->editor())
             return editor->spellChecker();
@@ -659,7 +664,6 @@ void InputHandler::setElementUnfocused(bool refocusOccuring)
             notifyClientOfKeyboardVisibilityChange(false);
 
         m_webPage->m_client->inputFocusLost();
-        m_webPage->m_selectionHandler->selectionPositionChanged();
 
         // If the frame selection isn't focused, focus it.
         if (!m_currentFocusElement->document()->frame()->selection()->isFocused())
@@ -1029,6 +1033,11 @@ void InputHandler::notifyClientOfKeyboardVisibilityChange(bool visible)
     if (!isInputModeEnabled() && visible)
         return;
 
+    if (processingChange()) {
+        ASSERT(visible);
+        return;
+    }
+
     if (!m_delayKeyboardVisibilityChange) {
         m_webPage->showVirtualKeyboard(visible);
         return;
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.cpp b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.cpp
index fa48cd6aa..ee5d33346 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.cpp
@@ -24,52 +24,46 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
-#include "Page.h"
-#include "Settings.h"
 #include "WebPage_p.h"
 
 
-namespace WebCore {
+namespace BlackBerry {
+namespace WebKit {
 
-PassOwnPtr<InspectorOverlay> InspectorOverlay::create(BlackBerry::WebKit::WebPagePrivate* page, InspectorOverlayClient* client)
+PassOwnPtr<InspectorOverlay> InspectorOverlay::create(WebPagePrivate* page, InspectorOverlayClient* client)
 {
     return adoptPtr(new InspectorOverlay(page, client));
 }
 
-InspectorOverlay::InspectorOverlay(BlackBerry::WebKit::WebPagePrivate* page, InspectorOverlayClient* client)
+InspectorOverlay::InspectorOverlay(WebPagePrivate* page, InspectorOverlayClient* client)
     : m_webPage(page)
     , m_client(client)
 {
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-void InspectorOverlay::notifySyncRequired(const GraphicsLayer*)
+void InspectorOverlay::notifySyncRequired(const WebCore::GraphicsLayer* layer)
 {
-    m_webPage->scheduleRootLayerCommit();
+    m_webPage->notifySyncRequired(layer);
 }
 
-void InspectorOverlay::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase, const IntRect& inClip)
+void InspectorOverlay::paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext& context, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip)
 {
     context.save();
-    IntPoint scrollPosition = m_webPage->focusedOrMainFrame()->view()->scrollPosition();
+    WebCore::IntPoint scrollPosition = m_webPage->focusedOrMainFrame()->view()->scrollPosition();
     context.translate(scrollPosition.x(), scrollPosition.y());
     m_client->paintInspectorOverlay(context);
     context.restore();
 }
 
-bool InspectorOverlay::showDebugBorders(const GraphicsLayer*) const
+bool InspectorOverlay::showDebugBorders(const WebCore::GraphicsLayer* layer) const
 {
-    return m_webPage->m_page->settings()->showDebugBorders();
+    return m_webPage->showDebugBorders(layer);
 }
 
-bool InspectorOverlay::showRepaintCounter(const GraphicsLayer*) const
+bool InspectorOverlay::showRepaintCounter(const WebCore::GraphicsLayer* layer) const
 {
-    return m_webPage->m_page->settings()->showRepaintCounter();
-}
-
-bool InspectorOverlay::contentsVisible(const GraphicsLayer*, const IntRect& contentRect) const
-{
-    return true;
+    return m_webPage->showRepaintCounter(layer);
 }
 #endif
 
@@ -89,9 +83,9 @@ void InspectorOverlay::update()
 {
 #if USE(ACCELERATED_COMPOSITING)
     if (!m_overlay) {
-        m_overlay = adoptPtr(new BlackBerry::WebKit::WebOverlay(this));
-        const IntSize size = m_webPage->contentsSize();
-        m_overlay->setSize(FloatSize(size.width(), size.height()));
+        m_overlay = adoptPtr(new WebOverlay(this));
+        const WebCore::IntSize size = m_webPage->contentsSize();
+        m_overlay->setSize(WebCore::FloatSize(size.width(), size.height()));
         m_webPage->m_webPage->addOverlay(m_overlay.get());
     }
 
@@ -102,3 +96,4 @@ void InspectorOverlay::update()
 }
 
 }
+}
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.h b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.h
index 7f91e3541..e341f364f 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorOverlay.h
+++ b/Source/WebKit/blackberry/WebKitSupport/InspectorOverlay.h
@@ -24,25 +24,23 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
-namespace BlackBerry {
-namespace WebKit {
-class WebPagePrivate;
-}
-}
-
 namespace WebCore {
 class GraphicsContext;
 class GraphicsLayer;
+}
 
+namespace BlackBerry {
+namespace WebKit {
+class WebPagePrivate;
 
 class InspectorOverlay : public WebCore::GraphicsLayerClient {
 public:
     class InspectorOverlayClient {
     public:
-        virtual void paintInspectorOverlay(GraphicsContext&) = 0;
+        virtual void paintInspectorOverlay(WebCore::GraphicsContext&) = 0;
     };
 
-    static PassOwnPtr<InspectorOverlay> create(BlackBerry::WebKit::WebPagePrivate*, InspectorOverlayClient*);
+    static PassOwnPtr<InspectorOverlay> create(WebPagePrivate*, InspectorOverlayClient*);
 
     ~InspectorOverlay();
 
@@ -50,28 +48,26 @@ public:
 
     void clear();
     void update();
-    void paintWebFrame(GraphicsContext&);
+    void paintWebFrame(WebCore::GraphicsContext&);
 
 #if USE(ACCELERATED_COMPOSITING)
-    virtual void notifyAnimationStarted(const GraphicsLayer*, double time) { }
-    virtual void notifySyncRequired(const GraphicsLayer*);
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip);
-    virtual bool showDebugBorders(const GraphicsLayer*) const;
-    virtual bool showRepaintCounter(const GraphicsLayer*) const;
-
-    virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const;
+    virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
+    virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
+    virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 #endif
 
 private:
-    InspectorOverlay(BlackBerry::WebKit::WebPagePrivate*, InspectorOverlayClient*);
+    InspectorOverlay(WebPagePrivate*, InspectorOverlayClient*);
     void invalidateWebFrame();
 
-    BlackBerry::WebKit::WebPagePrivate* m_webPage;
+    WebPagePrivate* m_webPage;
     InspectorOverlayClient* m_client;
-    OwnPtr<BlackBerry::WebKit::WebOverlay> m_overlay;
+    OwnPtr<WebOverlay> m_overlay;
 };
 
-} // namespace WebCore
-
+} // namespace WebKit
+} // namespace BlackBerry
 
 #endif /* InspectorOverlay_h */
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
index 7047204e7..3b04247be 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.cpp
@@ -243,7 +243,7 @@ void SelectionHandler::setCaretPosition(const WebCore::IntPoint &position)
     WebCore::IntRect currentCaretRect = controller->selection().visibleStart().absoluteCaretBounds();
 
     if (relativePoint == DOMSupport::InvalidPoint || !shouldUpdateSelectionOrCaretForPoint(relativePoint, currentCaretRect)) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
@@ -253,13 +253,15 @@ void SelectionHandler::setCaretPosition(const WebCore::IntPoint &position)
         if (unsigned short character = directionOfPointRelativeToRect(relativePoint, currentCaretRect))
             m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character));
 
-        selectionPositionChanged();
+        // Send the selection changed in case this does not trigger a selection change to
+        // ensure the caret position is accurate. This may be a duplicate event.
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
     VisibleSelection newSelection(visibleCaretPosition);
     if (controller->selection() == newSelection) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
@@ -403,7 +405,7 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
     // Check if the handle movement is valid.
     if (!shouldUpdateSelectionOrCaretForPoint(relativeStart, currentStartCaretRect, true /* startCaret */)
         || !shouldUpdateSelectionOrCaretForPoint(relativeEnd, currentEndCaretRect, false /* startCaret */)) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return true;
     }
 
@@ -438,9 +440,9 @@ bool SelectionHandler::updateOrHandleInputSelection(VisibleSelection& newSelecti
     if (shouldExtendSelectionInDirection(controller->selection(), character))
         m_webPage->m_inputHandler->handleKeyboardInput(Platform::KeyboardEvent(character, Platform::KeyboardEvent::KeyDown, KEYMOD_SHIFT));
 
-    // Must send the selectionPositionChanged every time, sometimes this will duplicate but an accepted
-    // handleNavigationMove may not make an actual selection change.
-    selectionPositionChanged();
+    // Send the selection changed in case this does not trigger a selection change to
+    // ensure the caret position is accurate. This may be a duplicate event.
+    selectionPositionChanged(true /* forceUpdateWithoutChange */);
     return true;
 }
 
@@ -513,7 +515,7 @@ void SelectionHandler::setSelection(const WebCore::IntPoint& start, const WebCor
     }
 
     if (controller->selection() == newSelection) {
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
         return;
     }
 
@@ -525,20 +527,21 @@ void SelectionHandler::setSelection(const WebCore::IntPoint& start, const WebCor
 
     IntRectRegion unclippedRegion;
     regionForTextQuads(quads, unclippedRegion, false /* shouldClipToVisibleContent */);
-    if (!unclippedRegion.isEmpty()) {
-        // Check if the handles reversed position.
-        if (m_selectionActive && !newSelection.isBaseFirst())
-            m_webPage->m_client->notifySelectionHandlesReversed();
-
-        controller->setSelection(newSelection);
 
-        SelectionLog(LogLevelInfo, "SelectionHandler::setSelection selection points valid, selection updated.");
-    } else {
+    if (unclippedRegion.isEmpty()) {
         // Requested selection results in an empty selection, skip this change.
-        selectionPositionChanged();
+        selectionPositionChanged(true /* forceUpdateWithoutChange */);
 
         SelectionLog(LogLevelWarn, "SelectionHandler::setSelection selection points invalid, selection not updated.");
+        return;
     }
+
+    // Check if the handles reversed position.
+    if (m_selectionActive && !newSelection.isBaseFirst())
+        m_webPage->m_client->notifySelectionHandlesReversed();
+
+    controller->setSelection(newSelection);
+    SelectionLog(LogLevelInfo, "SelectionHandler::setSelection selection points valid, selection updated.");
 }
 
 // FIXME re-use this in context. Must be updated to include an option to return the href.
@@ -838,9 +841,9 @@ bool SelectionHandler::inputNodeOverridesTouch() const
 
 // Note: This is the only function in SelectionHandler in which the coordinate
 // system is not entirely WebKit.
-void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
+void SelectionHandler::selectionPositionChanged(bool forceUpdateWithoutChange)
 {
-    SelectionLog(LogLevelInfo, "SelectionHandler::selectionPositionChanged visibleChangeOnly = %s", visualChangeOnly ? "true" : "false");
+    SelectionLog(LogLevelInfo, "SelectionHandler::selectionPositionChanged forceUpdateWithoutChange = %s", forceUpdateWithoutChange ? "true" : "false");
 
     // This method can get called during WebPage shutdown process.
     // If that is the case, just bail out since the client is not
@@ -883,7 +886,7 @@ void SelectionHandler::selectionPositionChanged(bool visualChangeOnly)
 
     // If there is no change in selected text and the visual rects
     // have not changed then don't bother notifying anything.
-    if (visualChangeOnly && m_lastSelectionRegion.isEqual(unclippedRegion))
+    if (!forceUpdateWithoutChange && m_lastSelectionRegion.isEqual(unclippedRegion))
         return;
 
     m_lastSelectionRegion = unclippedRegion;
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
index b0833c2c1..36895e3a5 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionHandler.h
@@ -65,7 +65,7 @@ public:
     void selectObject(WebCore::TextGranularity);
     void selectObject(WebCore::Node*);
 
-    void selectionPositionChanged(bool visualChangeOnly = false);
+    void selectionPositionChanged(bool forceUpdateWithoutChange = false);
 
     void setCaretPosition(const WebCore::IntPoint&);
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
index 58fd28e26..cd8c35d93 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
@@ -94,9 +94,9 @@ void SelectionOverlay::hide()
     m_page->m_webPage->removeOverlay(m_overlay.get());
 }
 
-void SelectionOverlay::notifySyncRequired(const GraphicsLayer*)
+void SelectionOverlay::notifySyncRequired(const GraphicsLayer* layer)
 {
-    m_page->scheduleRootLayerCommit();
+    m_page->notifySyncRequired(layer);
 }
 
 void SelectionOverlay::paintContents(const GraphicsLayer*, GraphicsContext& c, GraphicsLayerPaintingPhase, const IntRect& inClip)
@@ -133,6 +133,16 @@ void SelectionOverlay::paintContents(const GraphicsLayer*, GraphicsContext& c, G
     c.restore();
 }
 
+bool SelectionOverlay::showDebugBorders(const GraphicsLayer* layer) const
+{
+    return m_page->showDebugBorders(layer);
+}
+
+bool SelectionOverlay::showRepaintCounter(const GraphicsLayer* layer) const
+{
+    return m_page->showRepaintCounter(layer);
+}
+
 } // namespace WebKit
 } // namespace BlackBerry
 
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
index 12731c581..be61e764b 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
@@ -52,10 +52,8 @@ public:
     virtual void notifyAnimationStarted(const WebCore::GraphicsLayer*, double time) { }
     virtual void notifySyncRequired(const WebCore::GraphicsLayer*);
     virtual void paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& inClip);
-    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const { return false; }
-    virtual bool contentsVisible(const WebCore::GraphicsLayer*, const WebCore::IntRect& contentRect) const { return true; }
-
+    virtual bool showDebugBorders(const WebCore::GraphicsLayer*) const;
+    virtual bool showRepaintCounter(const WebCore::GraphicsLayer*) const;
 
 private:
     SelectionOverlay(WebPagePrivate*);
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
index de4fe5caa..e4c99ed7b 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.cpp
@@ -25,16 +25,29 @@
 #include "BackingStoreCompositingSurface.h"
 #endif
 
+#include <BlackBerryPlatformGraphics.h>
 #include <BlackBerryPlatformLog.h>
 #include <BlackBerryPlatformMisc.h>
 #include <BlackBerryPlatformScreen.h>
 #include <BlackBerryPlatformSettings.h>
+#include <BlackBerryPlatformThreading.h>
+#include <errno.h>
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+#include <EGL/eglext.h>
+#endif
 
 #define SHARED_PIXMAP_GROUP "webkit_backingstore_group"
 
 namespace BlackBerry {
 namespace WebKit {
 
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+static PFNEGLCREATESYNCKHRPROC eglCreateSyncKHR;
+static PFNEGLDESTROYSYNCKHRPROC eglDestroySyncKHR;
+static PFNEGLCLIENTWAITSYNCKHRPROC eglClientWaitSyncKHR;
+#endif
+
 #if USE(ACCELERATED_COMPOSITING) && ENABLE_COMPOSITING_SURFACE
 static PassRefPtr<BackingStoreCompositingSurface> createCompositingSurface()
 {
@@ -60,6 +73,7 @@ SurfacePool::SurfacePool()
     , m_backBuffer(0)
     , m_initialized(false)
     , m_buffersSuspended(false)
+    , m_hasFenceExtension(false)
 {
 }
 
@@ -95,6 +109,21 @@ void SurfacePool::initialize(const BlackBerry::Platform::IntSize& tileSize)
 
     for (size_t i = 0; i < numberOfTiles; ++i)
         m_tilePool.append(BackingStoreTile::create(tileSize, BackingStoreTile::DoubleBuffered));
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+    const char* extensions = eglQueryString(Platform::Graphics::eglDisplay(), EGL_EXTENSIONS);
+    if (strstr(extensions, "EGL_KHR_fence_sync")) {
+        // We assume GL_OES_EGL_sync is present, but we don't check for it because
+        // no GL context is current at this point.
+        // TODO: check for it
+        eglCreateSyncKHR = (PFNEGLCREATESYNCKHRPROC) eglGetProcAddress("eglCreateSyncKHR");
+        eglDestroySyncKHR = (PFNEGLDESTROYSYNCKHRPROC) eglGetProcAddress("eglDestroySyncKHR");
+        eglClientWaitSyncKHR = (PFNEGLCLIENTWAITSYNCKHRPROC) eglGetProcAddress("eglClientWaitSyncKHR");
+        m_hasFenceExtension = eglCreateSyncKHR && eglDestroySyncKHR && eglClientWaitSyncKHR;
+    }
+#endif
+
+    pthread_mutex_init(&m_mutex, 0);
 }
 
 PlatformGraphicsContext* SurfacePool::createPlatformGraphicsContext(BlackBerry::Platform::Graphics::Drawable* drawable) const
@@ -199,5 +228,71 @@ void SurfacePool::releaseBuffers()
     }
 }
 
+void SurfacePool::waitForBuffer(TileBuffer* tileBuffer)
+{
+    if (!m_hasFenceExtension)
+        return;
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+    EGLSyncKHR syncObject;
+
+    {
+        Platform::MutexLocker locker(&m_mutex);
+        syncObject = tileBuffer->syncObject();
+        if (!syncObject)
+            return;
+
+        // Stale references to this sync object may remain with other tiles, don't wait for it again.
+        for (unsigned int i = 0; i < m_tilePool.size(); ++i) {
+            TileBuffer* tileBuffer = m_tilePool[i]->frontBuffer();
+            if (tileBuffer->syncObject() == syncObject)
+                tileBuffer->setSyncObject(0);
+        }
+        if (backBuffer()->syncObject() == syncObject)
+            backBuffer()->setSyncObject(0);
+    }
+
+    eglClientWaitSyncKHR(Platform::Graphics::eglDisplay(), syncObject, 0, 100000000LL);
+
+    // Instead of assuming eglDestroySyncKHR is thread safe, we add it to
+    // a garbage list for later collection on the thread that created it.
+    {
+        Platform::MutexLocker locker(&m_mutex);
+        m_syncObjectsToDestroy.insert(syncObject);
+    }
+#endif
+}
+
+void SurfacePool::notifyBuffersComposited(const Vector<TileBuffer*>& tileBuffers)
+{
+    if (!m_hasFenceExtension)
+        return;
+
+#if BLACKBERRY_PLATFORM_GRAPHICS_EGL
+    Platform::MutexLocker locker(&m_mutex);
+
+    EGLDisplay display = Platform::Graphics::eglDisplay();
+
+    // The EGL_KHR_fence_sync spec is nice enough to specify that the sync object
+    // is not actually deleted until everyone has stopped using it.
+    for (std::set<void*>::const_iterator it = m_syncObjectsToDestroy.begin(); it != m_syncObjectsToDestroy.end(); ++it)
+        eglDestroySyncKHR(display, *it);
+    m_syncObjectsToDestroy.clear();
+
+    // If we didn't blit anything, we don't need to create a new sync object.
+    if (tileBuffers.isEmpty())
+        return;
+
+    EGLSyncKHR syncObject = eglCreateSyncKHR(display, EGL_SYNC_FENCE_KHR, 0);
+
+    for (unsigned int i = 0; i < tileBuffers.size(); ++i) {
+        if (EGLSyncKHR previousSyncObject = tileBuffers[i]->syncObject())
+            m_syncObjectsToDestroy.insert(previousSyncObject);
+
+        tileBuffers[i]->setSyncObject(syncObject);
+    }
+#endif
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
index fa88a5d6a..1c50df81b 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SurfacePool.h
@@ -25,6 +25,8 @@
 
 #include <BlackBerryPlatformGraphics.h>
 #include <BlackBerryPlatformPrimitives.h>
+#include <pthread.h>
+#include <set>
 #include <wtf/Vector.h>
 
 #define ENABLE_COMPOSITING_SURFACE 1
@@ -71,6 +73,16 @@ public:
     void releaseBuffers();
     void createBuffers();
 
+    // EGLImage synchronization between WebKit and compositing threads
+    // TODO: Figure out how to improve the BlackBerry::Platform::Graphics with API that can encapsulate
+    // this kind of synchronisation mechanism.
+
+    // WebKit thread must waitForBuffer() before rendering to EGLImage
+    void waitForBuffer(TileBuffer*);
+
+    // Compositing thread must notify the SurfacePool when EGLImages are composited
+    void notifyBuffersComposited(const Vector<TileBuffer*>& buffers);
+
 private:
     // This is necessary so BackingStoreTile can atomically swap buffers with m_backBuffer.
     friend class BackingStoreTile;
@@ -86,6 +98,10 @@ private:
     unsigned m_backBuffer;
     bool m_initialized; // SurfacePool has been set up, with or without buffers.
     bool m_buffersSuspended; // Buffer objects exist, but pixel memory has been freed.
+
+    std::set<void*> m_syncObjectsToDestroy;
+    bool m_hasFenceExtension;
+    mutable pthread_mutex_t m_mutex;
 };
 }
 }
diff --git a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
index c8668be85..492aeaa36 100644
--- a/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/TouchEventHandler.cpp
@@ -31,6 +31,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
+#include "InRegionScroller_p.h"
 #include "InputHandler.h"
 #include "IntRect.h"
 #include "IntSize.h"
@@ -363,7 +364,7 @@ void TouchEventHandler::drawTapHighlight()
     // On the client side, this info is being used to hide the tap highlight window on scroll.
     RenderLayer* layer = m_webPage->enclosingFixedPositionedAncestorOrSelfIfFixedPositioned(renderer->enclosingLayer());
     bool shouldHideTapHighlightRightAfterScrolling = !layer->renderer()->isRenderView();
-    shouldHideTapHighlightRightAfterScrolling |= !!m_webPage->m_inRegionScrollStartingNode.get();
+    shouldHideTapHighlightRightAfterScrolling |= !!m_webPage->m_inRegionScroller->d->node();
 
     IntPoint framePos(m_webPage->frameOffset(elementFrame));
 
diff --git a/Source/WebKit/chromium/.gitignore b/Source/WebKit/chromium/.gitignore
index eece02216..4def72c92 100644
--- a/Source/WebKit/chromium/.gitignore
+++ b/Source/WebKit/chromium/.gitignore
@@ -15,6 +15,7 @@ WebKitUnitTests.xcodeproj
 .gclient
 .gclient_entries
 base/
+cc/
 chromium_deps/
 crypto/
 depot_tools/
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index c9b02eb2e..3d9ea37fa 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,2462 @@
+2012-08-09  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove forwarding headers for compositor-related WebKit API and update includes
+        https://bugs.webkit.org/show_bug.cgi?id=93669
+
+        Reviewed by Adam Barth.
+
+        This updates all includes for compositor-related headers to refer consistently to the Platform API location and
+        removes the now-unneeded forwarding headers in the client API location. I also updated and resorted other
+        platform API includes in modified header blocks.
+
+        * WebKit.gyp:
+        * public/WebCompositor.h: Removed.
+        * public/platform/WebContentLayer.h: Removed.
+        * public/platform/WebContentLayerClient.h: Removed.
+        * public/platform/WebExternalTextureLayer.h: Removed.
+        * public/platform/WebLayer.h: Removed.
+        * public/platform/WebLayerTreeView.h: Removed.
+        * public/platform/WebLayerTreeViewClient.h: Removed.
+        * public/platform/WebSolidColorLayer.h: Removed.
+        * src/WebCompositorInputHandlerImpl.h:
+        * src/WebContentLayerImpl.cpp:
+        * src/WebLayer.cpp:
+        * src/WebLayerTreeView.cpp:
+        * src/WebLayerTreeViewImpl.cpp:
+        * src/WebLayerTreeViewImpl.h:
+        * src/WebSolidColorLayer.cpp:
+        * src/WebViewImpl.h:
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        * tests/GraphicsLayerChromiumTest.cpp:
+        * tests/TextureLayerChromiumTest.cpp:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-10  Iain Merrick  <husky@google.com>
+
+        [chromium] Upstream Android changes to WebFrameImpl::selectRange
+        https://bugs.webkit.org/show_bug.cgi?id=92513
+
+        Reviewed by Ryosuke Niwa.
+
+        This change is driven by the Chromium port on the Android platform,
+        but it should be suitable for other touch-based platforms. We reuse
+        selectionExtentRespectingEditingBoundary (extracted from EventHandler
+        into VisibleSelection).
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::selectRange):
+        (WebKit::WebFrameImpl::visiblePositionForWindowPoint):
+
+2012-08-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove targetSurface pointer from CCRenderPass
+        https://bugs.webkit.org/show_bug.cgi?id=93734
+
+        Reviewed by Adrienne Walker.
+
+        Use the RenderPass's damageRect instead of the surface's damageRect
+        directly to test the same things without requiring a pointer to
+        the surface that generated the RenderPass.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125310.
+        http://trac.webkit.org/changeset/125310
+        https://bugs.webkit.org/show_bug.cgi?id=93739
+
+        The DEPS roll broke Android. One does not simply break
+        Android. (Requested by fmalita_ on #webkit).
+
+        * DEPS:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove scissor from the namings in CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=93630
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebKitTests::TestCCOcclusionTrackerWithClip::TestCCOcclusionTrackerWithClip):
+        (WebKitTests::TestCCOcclusionTrackerWithClip::setLayerClipRect):
+        (WebKitTests::TestCCOcclusionTrackerWithClip::useDefaultLayerClipRect):
+        (WebKitTests::TestCCOcclusionTrackerWithClip::layerClipRectInTarget):
+        (TestCCOcclusionTrackerWithClip):
+        (WebKitTests::CCOcclusionTrackerTestIdentityTransforms::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestRotatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestTranslatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestChildInRotatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestVisitTargetTwoTimes::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceRotatedOffAxis::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceWithTwoOpaqueChildren::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOverlappingSurfaceSiblings::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOverlappingSurfaceSiblingsWithTwoTransforms::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestFilters::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaDoesOcclude::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaWithClipping::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaWithMask::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectOutsideChild::runMyTest):
+        (WebKitTests):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectOutsideChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectPartlyOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectPartlyOverChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectOverNothing::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestViewportRectOverNothing::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerClipRectForLayerOffOrigin::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOpaqueContentsRegionEmpty::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestOpaqueContentsRegionNonEmpty::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTest3dTransform::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestUnsorted3dLayers::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestPerspectiveTransform::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestPerspectiveTransformBehindCamera::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLayerBehindCameraDoesNotOcclude::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestLargePixelsOccludeInsideClipRect::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestAnimationOpacity1OnMainThread::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestAnimationOpacity0OnMainThread::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestAnimationTranslateOnMainThread::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceOcclusionTranslatesToParent::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceOcclusionTranslatesWithClipping::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReplicaOccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceWithReplicaUnoccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceAndReplicaOccludedDifferently::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceChildOfSurface::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestTopmostSurfaceIsClippedToViewport::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestSurfaceChildOfClippingSurface::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontOccludePixelsNeededForBackgroundFilter::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestTwoBackgroundFiltersReduceOcclusionTwice::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontOccludePixelsNeededForBackgroundFilterWithClip::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontReduceOcclusionBelowBackgroundFilter::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestDontReduceOcclusionIfBackgroundFilterIsOccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestReduceOcclusionWhenBackgroundFilterIsPartiallyOccluded::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestMinimumTrackingSize::runMyTest):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r125230 and r125238.
+        http://trac.webkit.org/changeset/125230
+        http://trac.webkit.org/changeset/125238
+        https://bugs.webkit.org/show_bug.cgi?id=93698
+
+        Broke ChromiumOS browser tests. (Requested by yutak on
+        #webkit).
+
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-09  Eric Penner  <epenner@google.com>
+
+        [chromium] Paint animated layers immediately to avoid animation hiccups.
+        https://bugs.webkit.org/show_bug.cgi?id=93028
+
+        Reviewed by Adrienne Walker.
+
+        Replaced one test. Test painting full animated layer.
+
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-09  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Remove missing files from WebKit.gyp introduced by r125219
+        https://bugs.webkit.org/show_bug.cgi?id=93671
+
+        Unreviewed. Fixing windows build.
+
+        * WebKit.gyp:
+
+2012-08-09  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: add AssertMatchingEnums for Direction and TaskType
+        https://bugs.webkit.org/show_bug.cgi?id=93618
+
+        Reviewed by Tony Chang.
+
+        These chromium enums were introduced in a separate patch.
+
+        * src/AssertMatchingEnums.cpp:
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebSettings.h:
+        * public/WebViewClient.h:
+        (WebKit):
+        (WebViewClient):
+        (WebKit::WebViewClient::createOutputSurface):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit):
+        (WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebGraphicsContextToOutputSurfaceAdapter::WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebLayerTreeViewClientAdapter::WebLayerTreeViewClientAdapter):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::createOutputSurface):
+        (WebKit):
+        (WebKit::WebViewImpl::didRebindGraphicsContext):
+        (WebKit::WebViewImpl::didRecreateOutputSurface):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF):
+        (WTF::CCLayerTreeHostTestSetSingleLostContext::didRecreateOutputSurface):
+        (WTF::CCLayerTreeHostTestSetRepeatedLostContext::didRecreateOutputSurface):
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::CCResourceProviderTest::CCResourceProviderTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        (WebKitTests::TestHooks::createOutputSurface):
+        * tests/CCThreadedTest.h:
+        (WebKitTests::TestHooks::didRecreateOutputSurface):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        (Canvas2DLayerBridgeTest::fullLifecycleTest):
+        * tests/FakeCCGraphicsContext.h:
+        (WebKit::createFakeCCGraphicsContext):
+        * tests/FakeCCLayerTreeHostClient.h:
+        * tests/FakeWebCompositorOutputSurface.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h.
+        (WebKit):
+        (FakeWebCompositorOutputSurface):
+        (WebKit::FakeWebCompositorOutputSurface::create):
+        (WebKit::FakeWebCompositorOutputSurface::FakeWebCompositorOutputSurface):
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::LayerRendererChromiumTest):
+        (TEST):
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-09  Nat Duca  <nduca@chromium.org>
+
+        Unreviewed, rolling out r125212.
+        http://trac.webkit.org/changeset/125212
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Compile failure on mac dbg builder
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebSettings.h:
+        * public/WebViewClient.h:
+        (WebKit):
+        (WebViewClient):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewClientAdapter::WebLayerTreeViewClientAdapter):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        (WebKit::WebSettingsImpl::setForceSoftwareCompositing):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebKit::WebSettingsImpl::forceSoftwareCompositing):
+        (WebSettingsImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::createCompositorGraphicsContext3D):
+        (WebKit::WebViewImpl::createContext3D):
+        (WebKit::WebViewImpl::didRebindGraphicsContext):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF):
+        (WTF::CCLayerTreeHostTestSetSingleLostContext::didRecreateContext):
+        (WTF::CCLayerTreeHostTestSetRepeatedLostContext::didRecreateContext):
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::CCResourceProviderTest::CCResourceProviderTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        (WebKitTests::TestHooks::createContext):
+        * tests/CCThreadedTest.h:
+        (WebKitTests::TestHooks::didRecreateContext):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        (Canvas2DLayerBridgeTest::fullLifecycleTest):
+        * tests/FakeCCGraphicsContext.h:
+        (WebKit::createFakeCCGraphicsContext):
+        * tests/FakeCCLayerTreeHostClient.h:
+        * tests/FakeWebCompositorOutputSurface.h: Removed.
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::LayerRendererChromiumTest):
+        (TEST):
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Rename V8BindingPerIsolateData to V8PerIsolateData
+        https://bugs.webkit.org/show_bug.cgi?id=93592
+
+        Reviewed by Adam Barth.
+
+        For a better name. See discussion in bug 93333.
+
+        No tests. No change in behavior.
+
+        * src/WebKit.cpp:
+        (WebKit::initialize):
+
+2012-08-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Expose CCGraphicsContext as WebCompositorOutputSurface
+        https://bugs.webkit.org/show_bug.cgi?id=92890
+
+        Reviewed by James Robinson.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * public/WebSettings.h:
+        * public/WebViewClient.h:
+        (WebKit):
+        (WebViewClient):
+        (WebKit::WebViewClient::createOutputSurface):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit):
+        (WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebGraphicsContextToOutputSurfaceAdapter::WebGraphicsContextToOutputSurfaceAdapter):
+        (WebKit::WebLayerTreeViewClientAdapter::WebLayerTreeViewClientAdapter):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit::WebViewImpl::createOutputSurface):
+        (WebKit):
+        (WebKit::WebViewImpl::didRebindGraphicsContext):
+        (WebKit::WebViewImpl::didRecreateOutputSurface):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF):
+        (WTF::CCLayerTreeHostTestSetSingleLostContext::didRecreateOutputSurface):
+        (WTF::CCLayerTreeHostTestSetRepeatedLostContext::didRecreateOutputSurface):
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::CCResourceProviderTest::CCResourceProviderTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        (WebKitTests::TestHooks::createOutputSurface):
+        * tests/CCThreadedTest.h:
+        (WebKitTests::TestHooks::didRecreateOutputSurface):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        (Canvas2DLayerBridgeTest::fullLifecycleTest):
+        * tests/FakeCCGraphicsContext.h:
+        (WebKit::createFakeCCGraphicsContext):
+        * tests/FakeCCLayerTreeHostClient.h:
+        * tests/FakeWebCompositorOutputSurface.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h.
+        (WebKit):
+        (FakeWebCompositorOutputSurface):
+        (WebKit::FakeWebCompositorOutputSurface::create):
+        (WebKit::FakeWebCompositorOutputSurface::FakeWebCompositorOutputSurface):
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::LayerRendererChromiumTest):
+        (TEST):
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-09  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: additional chromium signature for openCursor
+        https://bugs.webkit.org/show_bug.cgi?id=93637
+
+        Reviewed by Adam Barth.
+
+        Stub out the TaskType-based openCursor in the chromium API.
+
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::openCursor):
+        * src/WebIDBObjectStoreImpl.h:
+        (WebKit::WebIDBObjectStoreImpl::openCursor):
+        (WebIDBObjectStoreImpl):
+
+2012-08-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Do partial-swap scissoring on quads during draw instead of on layers
+        https://bugs.webkit.org/show_bug.cgi?id=91800
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCDamageTrackerTest.cpp:
+        (WebKitTests::executeCalculateDrawTransformsAndVisibility):
+        * tests/CCLayerIteratorTest.cpp:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        Removed tests of the scissor rect here, as they are no longer
+        computed within CCLayerTreeHostCommon. Verify that the scissor
+        does not affect texture caching in CCLayerTreeHostImplTest now.
+        Previous scissor would affect the texture cache decisions, but
+        this was incorrect, as damaged areas are always inside the
+        scissor rect, and anything outside the scissor rect should
+        be considered as valid and complete (assuming no external
+        occlusion, which is computed outside the scissor rect now also).
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        Removed didDrawNotCalledOnScissoredLayer test, as this no longer
+        applies. didDraw will be called on layers that are outside the
+        partial swap rect, regardless.
+
+        Removed partialSwapNoUpdate test, and merged its functionality into
+        the partialSwap test while updating its expectations.
+
+        Added textureCachingWithScissor, which is loosely based on the
+        CCLayerTreeHostCommonTest.scissorRectWithClip test.
+
+        * tests/CCOcclusionTrackerTest.cpp:
+        (WebKitTests::CCOcclusionTrackerTest::calcDrawEtc):
+        (WebKitTests::CCOcclusionTrackerTestChildInRotatedChild::runMyTest):
+        (WebKitTests::CCOcclusionTrackerTestVisitTargetTwoTimes::runMyTest):
+        * tests/CCQuadCullerTest.cpp:
+        * tests/CCRenderSurfaceTest.cpp:
+        * tests/CCSolidColorLayerImplTest.cpp:
+        (CCLayerTestCommon::TEST):
+        * tests/CCTiledLayerImplTest.cpp:
+        (CCLayerTestCommon::createLayer):
+        * tests/LayerRendererChromiumTest.cpp:
+        (LayerRendererChromiumTest::swapBuffers):
+        (TEST_F):
+        (TEST):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-09  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Pass mask scale and offset to shaders for correct masking
+        https://bugs.webkit.org/show_bug.cgi?id=93558
+
+        Reviewed by Adrienne Walker.
+
+        Updated one unit test that needed additional args in a
+        constructor, but no change in behavior of the test.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add codemirror library as an experiment
+        https://bugs.webkit.org/show_bug.cgi?id=93620
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebKit.gyp:
+
+2012-08-09  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed, rolling out r125171.
+        http://trac.webkit.org/changeset/125171
+
+        Broke the Chromium Android build.
+
+        * DEPS:
+
+2012-08-09  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-09  Keishi Hattori  <keishi@webkit.org>
+
+        Page popups can show up at wrong locations
+        https://bugs.webkit.org/show_bug.cgi?id=93556
+
+        Reviewed by Kent Tamura.
+
+        We were showing the popup at wrong positions. When there isn't enough
+        room below and above the element it adjusts the position but we weren't
+        resetting the adjustment when we resize the popup. This patch will make
+        the popup adjust the popup position each time we resize.
+
+        * src/ColorChooserUIController.cpp:
+        (WebKit::ColorChooserUIController::contentSize):
+        * src/WebPagePopupImpl.cpp:
+        (WevKit::PagePopupChromeClient::setWindowRect):
+        (WebKit::WebPagePopupImpl::init): Use reposition().
+        (WebKit::WebPagePopupImpl::reposition): Repositions the page popup based on the popup size.
+        (WebKit):
+        (WebKit::WebPagePopupImpl::resize): Use reposition().
+        * src/WebPagePopupImpl.h:
+        (WebPagePopupImpl):
+
+2012-08-09  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Pull in the android_tools directory for Android
+        https://bugs.webkit.org/show_bug.cgi?id=84843
+
+        Reviewed by Jochen Eisinger.
+
+        Pull in the android_tools directory for Chromium Android checkouts. This
+        repository, living in Chromium's, contains checked in versions of the
+        Android NDK and SDK meant to make builds and updates easier.
+
+        * DEPS:
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * features.gypi:
+
+2012-08-08  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-mac] Switch to LocalizedNumberMac from LocalizedNumberICU
+        https://bugs.webkit.org/show_bug.cgi?id=93432
+
+        Reviewed by Hajime Morita.
+
+        * tests/LocaleMacTest.cpp:
+        Add some tests for number localization. They are similar to tests in
+        LocaleWinTest and LocalizedNumberICUTest.cpp
+        (LocaleMacTest):
+        (LocaleMacTest::decimalSeparator):
+        (TEST_F):
+        (testNumberIsReversible):
+        (testNumbers):
+
+2012-08-08  Adrienne Walker  <enne@google.com>
+
+        [chromium] Move scrollbar pointer into WebScrollbarThemePainter
+        https://bugs.webkit.org/show_bug.cgi?id=93541
+
+        Reviewed by James Robinson.
+
+        Fix WebScrollbarThemePainter implementation to make direct calls on
+        the scrollbar rather than through the WebScrollbarThemeClientImpl
+        adapter.
+
+        * src/WebScrollbarThemePainter.cpp:
+        (WebKit::WebScrollbarThemePainter::assign):
+        (WebKit::WebScrollbarThemePainter::paintScrollbarBackground):
+        (WebKit::WebScrollbarThemePainter::paintTrackBackground):
+        (WebKit::WebScrollbarThemePainter::paintBackTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintForwardTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintTickmarks):
+        (WebKit::WebScrollbarThemePainter::paintThumb):
+        (WebKit::WebScrollbarThemePainter::WebScrollbarThemePainter):
+        * tests/ScrollbarLayerChromiumTest.cpp:
+        (WebCore::TEST):
+
+2012-08-08  Alexei Svitkine  <asvitkine@chromium.org>
+
+        [chromium/mac] Map NSEventPhaseMayBegin appropriately on 10.8
+        https://bugs.webkit.org/show_bug.cgi?id=93535
+
+        Reviewed by Dimitri Glazkov.
+
+        This enables putting two fingers on the track pad to show overlay scroll bars on 10.8+.
+
+        * src/mac/WebInputEventFactory.mm:
+        (WebKit::phaseForNSEventPhase):
+
+2012-08-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Fix up includes and types in chromium compositor unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=93553
+
+        Reviewed by Adrienne Walker.
+
+        This removes some unused GraphicsContext3DPrivate.h includes and adds some includes that were being implicitely
+        depending upon - mostly for wtf/PassOwnPtr.h.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (::CCLayerTreeHostTestCommit::beginTest):
+        (::CCLayerTreeHostTestCommit::commitCompleteOnCCThread):
+        * tests/CCRenderSurfaceFiltersTest.cpp:
+        * tests/CompositorFakeWebGraphicsContext3D.h:
+        * tests/FakeGraphicsContext3DTest.cpp:
+        * tests/FakeWebScrollbarThemeGeometry.h:
+        * tests/TextureCopierTest.cpp:
+        * tests/ThrottledTextureUploaderTest.cpp:
+
+2012-08-08  Eric Penner  <epenner@google.com>
+
+        [chromium] Refactor tile flags.
+        https://bugs.webkit.org/show_bug.cgi?id=93059
+
+        Reviewed by Adrienne Walker.
+
+        Minor fixes to existing tests.
+
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Clean up WebKit.h and WebKitPlatformSupport.h includes in chromium/src
+        https://bugs.webkit.org/show_bug.cgi?id=93539
+
+        Reviewed by Adam Barth.
+
+        Most of these files don't need either WebKit.h or WebKitPlatformSupport.h. Some need <public/Platform.h>, and
+        some are relying on the forwarding headers. This updates includes to what is actually needed and points platform
+        includes at <public/Foo.h> instead of "platform/Foo.h" where possible.
+
+        * src/ApplicationCacheHostInternal.h:
+        * src/AssociatedURLLoader.cpp:
+        * src/AsyncFileSystemChromium.cpp:
+        (WebCore::AsyncFileSystemChromium::AsyncFileSystemChromium):
+        * src/BlobRegistryProxy.cpp:
+        * src/ChromiumCurrentTime.cpp:
+        * src/ChromiumOSRandomSource.cpp:
+        * src/ChromiumThreading.cpp:
+        * src/EditorClientImpl.cpp:
+        * src/FrameLoaderClientImpl.cpp:
+        * src/IDBFactoryBackendProxy.cpp:
+        * src/LocalizedStrings.cpp:
+        * src/PlatformMessagePortChannel.cpp:
+        * src/WebCompositorInputHandlerImpl.cpp:
+        * src/WebMediaPlayerClientImpl.cpp:
+        * src/WebPluginContainerImpl.cpp:
+        * src/WebViewImpl.cpp:
+        * src/WebWorkerClientImpl.cpp:
+        * src/WorkerAsyncFileSystemChromium.cpp:
+        * src/WorkerFileWriterCallbacksBridge.cpp:
+
+2012-08-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Clean up includes in compositor unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=93531
+
+        Reviewed by Adrienne Walker.
+
+        This removes unused includes and updates Platform API headers to use the <public/Web...> style paths.
+
+        * tests/CCAnimationTestCommon.cpp:
+        * tests/CCKeyframedAnimationCurveTest.cpp:
+        * tests/CCLayerAnimationControllerTest.cpp:
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestLayerAddedWithAnimation::beginTest):
+        * tests/CCOcclusionTrackerTest.cpp:
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        * tests/FakeWebGraphicsContext3D.h:
+        * tests/LayerChromiumTest.cpp:
+        * tests/LayerRendererChromiumTest.cpp:
+        * tests/TiledLayerChromiumTest.cpp:
+        * tests/WebCompositorInputHandlerImplTest.cpp:
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Only use public Platform API in NonCompositedContentHost
+        https://bugs.webkit.org/show_bug.cgi?id=93423
+
+        Reviewed by Adrienne Walker.
+
+        Switches to using Web*Layer APIs in NonCompositedContentHost instead of reaching in to the LayerChromium and
+        updates unit tests for the nonCompositedContent->useLCDText flag rename.
+
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        * src/WebContentLayer.cpp:
+        (WebKit::WebContentLayer::setUseLCDText):
+        (WebKit):
+        (WebKit::WebContentLayer::setDrawCheckerboardForMissingTiles):
+        * src/WebViewImpl.cpp:
+        * tests/CCLayerImplTest.cpp:
+        (WebCore::TEST):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/LayerChromiumTest.cpp:
+
+2012-08-08  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: new enums and openCursor stub
+        https://bugs.webkit.org/show_bug.cgi?id=93410
+
+        Reviewed by Adam Barth.
+
+        This stubs out the TaskType and Direction enums that will be
+        required to land the chromium side of
+        https://bugs.webkit.org/show_bug.cgi?id=91125.
+
+        * public/WebIDBCursor.h:
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::setIndexKeys):
+        (WebKit::WebIDBObjectStore::setIndexesReady):
+        (WebIDBObjectStore):
+        (WebKit::WebIDBObjectStore::openCursor):
+        * public/WebIDBTransaction.h:
+
+2012-08-08  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Enable occlusion tracker in the occlusion tests for surface cacheing
+        https://bugs.webkit.org/show_bug.cgi?id=93500
+
+        Reviewed by Adrienne Walker.
+
+        The occlusion tracker is not being used in these tests except to do
+        scissoring. We want to test occlusion with these occlusion tests,
+        and when scissoring is not part of occlusion tracker, these
+        tests would become useless otherwise.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-08  Adam Barth  <abarth@webkit.org>
+
+        Crash when reloading a Chromium "platform" app
+        https://bugs.webkit.org/show_bug.cgi?id=93497
+
+        Reviewed by Eric Seidel.
+
+        Test that we don't crash when executing script during the
+        didCreateScriptContext callback.
+
+        * tests/WebFrameTest.cpp:
+        * tests/data/hello_world.html: Added.
+
+2012-08-07  Joshua Bell  <jsbell@chromium.org>
+
+        Layout Test storage/indexeddb/intversion-omit-parameter.html is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=92952
+
+        Reviewed by Tony Chang.
+
+        Added test to exercise WebCore::IDBRequest event callbacks after
+        the script context has stopped and ensure no asserts are hit.
+
+        * WebKit.gypi:
+        * tests/IDBRequestTest.cpp: Added.
+        (WebCore):
+        (WebCore::TEST):
+
+2012-08-07  Fady Samuel  <fsamuel@chromium.org>
+
+        Allow plugins to decide whether they are keyboard focusable
+        https://bugs.webkit.org/show_bug.cgi?id=88958
+
+        Reviewed by Anders Carlsson.
+
+        * public/WebPlugin.h:
+        (WebKit::WebPlugin::supportsKeyboardFocus):
+        * src/WebInputEventConversion.cpp:
+        (WebKit::WebKeyboardEventBuilder::WebKeyboardEventBuilder):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::supportsKeyboardFocus):
+        (WebKit):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Implement V8Proxy::registerExtensionIfNeeded() and remove redundant methods
+        https://bugs.webkit.org/show_bug.cgi?id=93209
+
+        Reviewed by Adam Barth.
+
+        By implementing V8Proxy::registerExtensionIfNeeded(), we can remove
+        registeredExtensionWithV8() and registerExtension().
+
+        No tests. No change in behavior.
+
+        * src/WebScriptController.cpp:
+        (WebKit::WebScriptController::registerExtension):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Add new gclient-managed cc directory to Source/WebKit/chromium/.gitignore
+        https://bugs.webkit.org/show_bug.cgi?id=93403
+
+        Reviewed by Eric Seidel.
+
+        * .gitignore:
+
+2012-08-07  Mihai Parparita  <mihaip@chromium.org>
+
+        [Chromium] Clean up WebScriptController.h comments
+        https://bugs.webkit.org/show_bug.cgi?id=93399
+
+        Reviewed by Adam Barth.
+
+        Remove references to overloaded WebScriptController::registerExtension
+        variants. They were removed in r68666.
+
+        * public/WebScriptController.h:
+        (WebScriptController):
+
+2012-08-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove #include Frame.h from V8Binding.h
+        https://bugs.webkit.org/show_bug.cgi?id=93326
+
+        Reviewed by Adam Barth.
+
+        We want to remove unnecessary #include in V8Binding.h
+        to avoid circular include dependency.
+
+        No tests. No change in behavior.
+
+        * src/WebBindings.cpp:
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Switch PlatformLayer typedef to Platform API type for PLATFORM(CHROMIUM)
+        https://bugs.webkit.org/show_bug.cgi?id=93335
+
+        Reviewed by Adrienne Walker.
+
+        Update for new PlatformLayer typedef. This removes knowledge of WebCore::LayerChromium from all classes
+        except for NonCompositedContentHost, which still punches through for a few minor APIs that I'll address
+        in a separate patch.
+
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        (WebKit::NonCompositedContentHost::setScrollLayer):
+        (WebKit::NonCompositedContentHost::scrollLayer):
+        (WebKit::NonCompositedContentHost::notifySyncRequired):
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::platformLayer):
+        * src/WebMediaPlayerClientImpl.h:
+        (WebMediaPlayerClientImpl):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::platformLayer):
+        * src/WebPluginContainerImpl.h:
+        (WebCore):
+        (WebPluginContainerImpl):
+        * src/WebScrollableLayer.cpp:
+        (WebKit::WebScrollableLayer::setNonFastScrollableRegion):
+        (WebKit):
+        (WebKit::WebScrollableLayer::setIsContainerForFixedPositionLayers):
+        (WebKit::WebScrollableLayer::setFixedToContainerLayer):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setRootGraphicsLayer):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        * tests/GraphicsLayerChromiumTest.cpp:
+        (WebKitTests::GraphicsLayerChromiumTest::GraphicsLayerChromiumTest):
+        (WebKitTests::TEST_F):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use WebCompositor interface in Platform API instead of CCProxy to query threaded compositor status
+        https://bugs.webkit.org/show_bug.cgi?id=93398
+
+        Reviewed by Adam Barth.
+
+        Converts non-compositor code that cares about threaded compositing status over to query WebCompositor instead of
+        CCProxy.
+
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::supportsType):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::composite):
+        (WebKit::WebViewImpl::scheduleAnimation):
+        (WebKit::WebViewImpl::scheduleComposite):
+
+2012-08-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move WebCompositor interface into Platform AP
+        https://bugs.webkit.org/show_bug.cgi?id=93391
+
+        Reviewed by Adam Barth.
+
+        * WebKit.gyp:
+        * public/WebCompositor.h:
+        * src/WebLayerTreeViewImpl.cpp:
+
+2012-08-07  Joshua Bell  <jsbell@chromium.org>
+
+        REGRESSION(r124865): It broke the ARM Chromium build
+        https://bugs.webkit.org/show_bug.cgi?id=93364
+
+        Reviewed by Csaba Osztrogonác.
+
+        Mark large constant with LL to satisfy a picky compiler.
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+
+2012-08-07  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: make the MemoryClassInfo class a not-template
+        https://bugs.webkit.org/show_bug.cgi?id=93265
+
+        Reviewed by Yury Semikhatsky.
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::Instrumented::reportMemoryUsage):
+        (WebCore::InstrumentedRefPtr::reportMemoryUsage):
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+        (WebCore::InstrumentedOther::reportMemoryUsage):
+        (WebCore::InstrumentedDOM::reportMemoryUsage):
+        (WebCore::NonVirtualInstrumented::reportMemoryUsage):
+
+2012-08-06  Yuta Kitamura  <yutak@chromium.org>
+
+        WebSocket.send() should accept ArrayBufferView
+        https://bugs.webkit.org/show_bug.cgi?id=90877
+
+        Reviewed by Kent Tamura.
+
+        * src/WebSocketImpl.cpp:
+        (WebKit::WebSocketImpl::sendArrayBuffer):
+        Apply change in function signature of WebSocketChannel::send().
+
+2012-08-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove lingering unwrap<>() calls in GraphicsLayerChromium.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=93319
+
+        Reviewed by Adrienne Walker.
+
+        * src/WebLayer.cpp:
+        (WebKit::WebLayer::setChildren):
+        (WebKit):
+        (WebKit::WebLayer::setReplicaLayer):
+        (WebKit::WebLayer::setDebugName):
+        (WebKit::WebLayer::clearRenderSurface):
+
+2012-08-06  Adrienne Walker  <enne@google.com>
+
+        [chromium] Convert WebScrollbarThemeGeometry from a concrete class to an interface
+        https://bugs.webkit.org/show_bug.cgi?id=93308
+
+        Reviewed by James Robinson.
+
+        Now that WebScrollbarThemeGeometry can have different implementations,
+        create a FakeWebScrollbarThemeGeometry for testing purposes rather
+        than just overriding a geometry-related virtual.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * src/WebScrollbarLayer.cpp:
+        (WebKit::WebScrollbarLayer::create):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/FakeWebScrollbarThemeGeometry.h: Added.
+        (WebKit):
+        (FakeWebScrollbarThemeGeometry):
+        (WebKit::FakeWebScrollbarThemeGeometry::create):
+        * tests/ScrollbarLayerChromiumTest.cpp:
+        (WebCore::TEST):
+
+2012-08-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Update chromium DEPS r150037 -> r150169
+        https://bugs.webkit.org/show_bug.cgi?id=93309
+
+        As the title says. Unreviewed.
+
+        * DEPS:
+
+2012-08-06  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Rename CCTextureUpdater to CCTextureUpdateQueue.
+        https://bugs.webkit.org/show_bug.cgi?id=93293
+
+        Reviewed by Adrienne Walker.
+
+        * src/WebExternalTextureLayer.cpp:
+        (WebKit::WebTextureUpdaterImpl::WebTextureUpdaterImpl):
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestLayerOcclusion::beginTest):
+        (WTF::CCLayerTreeHostTestLayerOcclusionWithFilters::beginTest):
+        (WTF::CCLayerTreeHostTestManySurfaces::beginTest):
+        * tests/CCTextureUpdateControllerTest.cpp:
+        * tests/CCThreadedTest.cpp:
+        * tests/CCTiledLayerTestCommon.cpp:
+        (WebKitTests::FakeTiledLayerChromium::update):
+        * tests/CCTiledLayerTestCommon.h:
+        (FakeTiledLayerChromium):
+        * tests/Canvas2DLayerBridgeTest.cpp:
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-06  Bear Travis  <betravis@adobe.com>
+
+        [CSS Exclusions] Add a command-line flag to enable / disable exclusions
+        https://bugs.webkit.org/show_bug.cgi?id=91420
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the interface code to expose the css exclusions runtime flag to
+        Chromium.
+
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures): Adding getters/setters for cssExclusions
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableCSSExclusions):
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::isCSSExclusionsEnabled):
+
+2012-08-06  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] WebTouchCandidatesInfo should be part of the Client API
+        https://bugs.webkit.org/show_bug.cgi?id=93088
+
+        Reviewed by Eric Seidel.
+
+        * WebKit.gyp:
+        * public/WebTouchCandidatesInfo.h: Copied from Source/Platform/chromium/public/WebTouchCandidatesInfo.h.
+        * src/WebViewImpl.cpp:
+
+2012-08-06  Adrienne Walker  <enne@google.com>
+
+        [chromium] REGRESSION(r124714): webkit_unit_tests asserts in Debug
+        https://bugs.webkit.org/show_bug.cgi?id=93297
+
+        Reviewed by James Robinson.
+
+        This is a quick fix to get debug unit tests working again by
+        implementing a virtual function that has ASSERT_NOT_REACHED in the
+        base class version.
+
+        * tests/ScrollAnimatorNoneTest.cpp:
+        (MockScrollableArea::scrollPosition):
+
+2012-08-06  Nasko Oskov  <nasko@chromium.org>
+
+        Adding APIs to Chromium WebKit API to allow for creating and monitoring frame hierarchy.
+        https://bugs.webkit.org/show_bug.cgi?id=93127
+
+        Reviewed by Adam Barth.
+
+        Add support in the API to monitor and create frame hierarchy to allow replicating it
+        across different instances of WebKit.
+
+        * public/WebDocument.h:
+        (WebDocument): Added createElement.
+        * public/WebFrame.h: Added assignedName.
+        * public/WebFrameClient.h:
+        (WebFrameClient):
+        (WebKit::WebFrameClient::didCreateFrame): Added to allow embedders to know when frames are created.
+        (WebKit::WebFrameClient::willCheckAndDispatchMessageEvent): Added the target frame as a parameter.
+        * public/WebNode.h:
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::willCheckAndDispatchMessageEvent):
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::createElement): Added to allow for creating frame elements.
+        (WebKit):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::uniqueName): Added to migrate callers to the matching WebCore API.
+        (WebKit):
+        (WebKit::WebFrameImpl::assignedName): Returns the name given to a frame, as opposed 
+        to the unique name, generated by WebKit.
+        (WebKit::WebFrameImpl::createChildFrame): Added call to the frame client's didCreateFrame.
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::appendChild): Added to allow for adding elements to the DOM.
+        (WebKit):
+        * tests/WebFrameTest.cpp:
+
+2012-08-06  David Reveman  <reveman@chromium.org>
+
+        [Chromium] Refactor CCTextureUpdater into CCTextureUpdater and CCTextureUpdateController.
+        https://bugs.webkit.org/show_bug.cgi?id=92596
+
+        Reviewed by Adrienne Walker.
+
+        * WebKit.gypi:
+        * src/WebExternalTextureLayer.cpp:
+        * tests/CCTextureUpdateControllerTest.cpp: Renamed from Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp.
+        * tests/CCTiledLayerTestCommon.h:
+        (WebKitTests::FakeTextureCopier::copyTexture):
+        (WebKitTests::FakeTextureUploader::uploadTexture):
+        * tests/TextureCopierTest.cpp:
+        (TEST):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-06  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Non-preserves-3d requires explicit flattening of screen-space transform.
+        https://bugs.webkit.org/show_bug.cgi?id=85808
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostCommonTest.cpp:
+
+2012-08-06  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: rename WorkerAgent.setWorkerInspectionEnabled to WorkerAgent.enable and make it return error
+        https://bugs.webkit.org/show_bug.cgi?id=92545
+
+        Reviewed by Pavel Feldman.
+
+        Replaced Preferences.exposeWorkersInspection with InspectorFrontendHost.canInspectWorkers()
+        that tells if inspector front-end on the given platform can launch dedicated worker
+        front-end.
+
+        * src/InspectorFrontendClientImpl.cpp:
+        (WebKit::InspectorFrontendClientImpl::canInspectWorkers):
+        (WebKit):
+        * src/InspectorFrontendClientImpl.h:
+        (InspectorFrontendClientImpl):
+        * src/js/DevTools.js:
+
+2012-08-06  Keishi Hattori  <keishi@webkit.org>
+
+        Remove minimum window size for PagePopup
+        https://bugs.webkit.org/show_bug.cgi?id=93100
+
+        Reviewed by Kent Tamura.
+
+        * src/WebPagePopupImpl.cpp: Returns 0x0 so the page popup can be smaller than 100x100.
+
+2012-08-05  Kent Tamura  <tkent@chromium.org>
+
+        [Chromium-win] Use system locale for number representation
+        https://bugs.webkit.org/show_bug.cgi?id=93085
+
+        Reviewed by Hajime Morita.
+
+        * WebKit.gypi:
+        Don't include Localized*ICUTest.cpp in Windows and OSX. They are unnecessary.
+        * tests/LocaleWinTest.cpp:
+        (LocaleWinTest): Add some LCID symbols.
+        (LocaleWinTest::decimalSeparator):
+        A helper for LocaleWinTest.decimalSeparator.
+        (TEST_F(LocaleWinTest, decimalSeparator)):
+        A test for LocaleWin::localizedDecimalSeparator(). This is a copy of the
+        corresponding test in LocalizedNumberICUTest.cpp.
+        (testNumberIsReversible):
+        A test helper LocaleWinTest.localizedNumberRoundTrip. This is a copy of
+        the corresponding test in LocalizedNumberICUTest.cpp.
+        (testNumbers): ditto.
+        (TEST_F(LocaleWinTest, localizedNumberRoundTrip)):
+        Tests for LocaleWin changes. This is a copy of the corresponding tests
+        in LocalizedNumberICUTest.cpp.
+
+2012-08-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-03  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Add API to make it possible to request all variants of a WebImage
+        https://bugs.webkit.org/show_bug.cgi?id=92933
+
+        Reviewed by Adam Barth.
+
+        Part of http://crbug.com/138550
+
+        * src/WebImageSkia.cpp:
+        (WebKit::WebImage::framesFromData):
+        (WebKit):
+
+2012-08-03  Yaron Friedman  <yfriedman@chromium.org>
+
+        [Chrome-Android] - Prepare apk tests for switch to checked in SDK.
+        https://bugs.webkit.org/show_bug.cgi?id=92931
+
+        Reviewed by Adam Barth.
+
+        Pass Android-specific gyp variables to the native test generator
+        avoiding any dependencies on environment variables during build time.
+
+        * WebKitUnitTests.gyp:
+
+2012-08-03  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Core upgradeneeded logic
+        https://bugs.webkit.org/show_bug.cgi?id=92558
+
+        Reviewed by Ojan Vafai.
+
+        Update overridden methods to match new signatures.
+
+        * tests/IDBAbortOnCorruptTest.cpp:
+        (WebCore::FailingBackingStore::createIDBDatabaseMetaData):
+        * tests/IDBFakeBackingStore.h:
+
+2012-08-03  Rick Byers  <rbyers@chromium.org>
+
+        Double tap gesture should send dblclick event
+        https://bugs.webkit.org/show_bug.cgi?id=92412
+
+        Reviewed by Adam Barth.
+
+        Tweak comment to more completely describe the (lame) overloaded use
+        of deltaX in WebGestureEvent, and add a FIXME with the bug to track
+        cleaning it up.
+        * public/WebInputEvent.h:
+        (WebGestureEvent):
+
+2012-08-03  Dave Tu  <dtu@chromium.org>
+
+        [chromium] Remove assert when getting hardware renderingStats in software mode.
+        https://bugs.webkit.org/show_bug.cgi?id=92325
+
+        Reviewed by Adrienne Walker.
+
+        If a page caused hardware mode to be turned on, then off, the hardware stats are still valid, so we don't need to assert that we're in hardware mode. Checking if the LayerTreeView is null should be sufficient.
+
+        * public/WebWidget.h:
+        (WebWidget):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::renderingStats):
+        (WebKit::WebViewImpl::paint):
+        * src/WebViewImpl.h:
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124632.
+        http://trac.webkit.org/changeset/124632
+        https://bugs.webkit.org/show_bug.cgi?id=93154
+
+        Added new WebFrameTest.SelectRange which fails on bots
+        (Requested by dimich on #webkit).
+
+        * tests/WebFrameTest.cpp:
+        * tests/data/select_range_basic.html: Removed.
+        * tests/data/select_range_iframe.html: Removed.
+        * tests/data/select_range_scroll.html: Removed.
+
+2012-08-03  Terry Anderson  <tdanderson@chromium.org>
+
+        Apply target fuzzing when sending a context menu event
+        https://bugs.webkit.org/show_bug.cgi?id=92914
+
+        Reviewed by Antonio Gomes.
+
+        When constructing a PlatformEvent::GestureLongPress in WebInputEventConversion.cpp,
+        use |boundingBox| to specify |m_area|.
+
+        * src/WebInputEventConversion.cpp:
+        (WebKit::PlatformGestureEventBuilder::PlatformGestureEventBuilder):
+
+2012-08-03  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        [Chromium] Add stubs for the find-in-page match rects API
+        https://bugs.webkit.org/show_bug.cgi?id=93110
+
+        Reviewed by Adam Barth.
+
+        The Android port allows tapping on the find-in-page result tickmarks taking
+        the user to the corresponding matches. This patch introduces stubs for the
+        new required methods in order to achieve WebKit API compatibility for this
+        port as soon as possible. The implementation of these methods will be added
+        later in https://bugs.webkit.org/show_bug.cgi?id=93111.
+
+        * public/WebFrame.h:
+        (WebKit):
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::findMatchMarkersVersion):
+        (WebKit):
+        (WebKit::WebFrameImpl::activeFindMatchRect):
+        (WebKit::WebFrameImpl::findMatchRects):
+        (WebKit::WebFrameImpl::selectNearestFindMatch):
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+
+2012-08-03  Mike West  <mkwst@chromium.org>
+
+        Blocking a plugin via CSP should result in one (and only one) console message.
+        https://bugs.webkit.org/show_bug.cgi?id=92649
+
+        Reviewed by Adam Barth.
+
+        * src/LocalizedStrings.cpp:
+        (WebCore::blockedPluginByContentSecurityPolicyText):
+        (WebCore):
+            Adding a stub for the newly added string.
+
+2012-08-03  Oli Lan  <olilan@chromium.org>
+
+        [chromium] Add a test to WebFrameTest for selectRange and visiblePositionForWindowPoint.
+        https://bugs.webkit.org/show_bug.cgi?id=93108
+
+        Reviewed by Adam Barth.
+
+        Adds a new test WebFrameTest.SelectRange. This tests WebFrameImpl::selectRange, and also
+        serves to test WebFrameImpl::visiblePositionForWindowPoint as it is used by selectRange.
+
+        The test uses sample files that contain selected text on load. The test uses
+        WebViewImpl::selectionBounds to retrieve the ends of the selection, then unselects
+        and calls WebFrameImpl::selectRange to attempt to reselect the same text.
+
+        Three cases are tested: the normal case, the case where the selected text is offscreen
+        due to a scroll, and the case where the selected text is in an iframe. This allows the
+        problem cases and fix in https://bugs.webkit.org/show_bug.cgi?id=79117 to be tested.
+
+        * tests/WebFrameTest.cpp:
+        * tests/data/select_range_basic.html: Added.
+        * tests/data/select_range_iframe.html: Added.
+        * tests/data/select_range_scroll.html: Added.
+
+2012-08-03  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: eliminate visitBaseClass method from NMI. It introduces unnecessary complexity.
+        https://bugs.webkit.org/show_bug.cgi?id=93129
+
+        Reviewed by Yury Semikhatsky.
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+
+2012-08-03  Adam Barth  <abarth@webkit.org>
+
+        V8Proxy::retrieve(*) leads to really obfuscated code and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=93072
+
+        Reviewed by Eric Seidel.
+
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::didCreateScriptContext):
+
+2012-08-02  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: extend test coverage for nmi code and fix 2 bugs.
+        https://bugs.webkit.org/show_bug.cgi?id=92994
+
+        Reviewed by Yury Semikhatsky.
+
+        1) owner object type propagation.
+        If a class with object-type DOM has an instrumented member with object-type Other then it has to be recorded as DOM.
+        Sample: We have SharedBuffer class and we don't know the object-type for it but we know that it is owned by an object with object-type CachedResourceImage.
+
+        2) the first member of an instrumented non virtual class was skipped even if it was reported properly.
+        it happened because the first member has the same address as it's owner
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::TEST):
+        (WebCore):
+        (InstrumentedOther):
+        (WebCore::InstrumentedOther::InstrumentedOther):
+        (WebCore::InstrumentedOther::reportMemoryUsage):
+        (InstrumentedDOM):
+        (WebCore::InstrumentedDOM::InstrumentedDOM):
+        (WebCore::InstrumentedDOM::reportMemoryUsage):
+        (NonVirtualInstrumented):
+        (WebCore::NonVirtualInstrumented::reportMemoryUsage):
+
+2012-08-02  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: remove leftover chromium stubs from putIndexWithKeys
+        https://bugs.webkit.org/show_bug.cgi?id=93032
+
+        Reviewed by Darin Fisher.
+
+        Remove old chromium APIs that are no longer called by chrome.
+
+        * public/WebIDBCursor.h:
+        * public/WebIDBObjectStore.h:
+        * public/WebIDBTransaction.h:
+
+2012-08-02  Antoine Labour  <piman@chromium.org>
+
+        [chromium] add lost context test case for HW video decoder
+        https://bugs.webkit.org/show_bug.cgi?id=93057
+
+        Reviewed by Adrienne Walker.
+
+        We check that we don't use resources after a lost context (assuming
+        proper WebVideoFrameProvider behavior).
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124540.
+        http://trac.webkit.org/changeset/124540
+        https://bugs.webkit.org/show_bug.cgi?id=93055
+
+        Broke compile on Chromium Win bot (Requested by dimich on
+        #webkit).
+
+        * tests/IDBAbortOnCorruptTest.cpp:
+        (WebCore::FailingBackingStore::createIDBDatabaseMetaData):
+        * tests/IDBFakeBackingStore.h:
+
+2012-08-02  Alexandre Elias  <aelias@google.com>
+
+        [chromium] deviceViewportSize cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=92794
+
+        Reviewed by Adrienne Walker.
+
+        In the future, CSS layout size will become increasingly disassociated
+        from physical device size, and it will become impossible to infer one
+        from the other inside the compositor.  Therefore, this patch allows
+        deviceViewportSize to be explicitly passed in by the outside client.
+
+        I also renamed the existing viewportSize field to "layoutViewportSize"
+        for clarity, and converted its uses to deviceViewportSize since
+        that is more appropriate.
+
+        I had to add some default-value scaffolding to WebLayerTreeView in
+        order to avoid breaking ui/compositor.  We can delete it once that's
+        updated.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::setViewportSize):
+        (WebKit::WebLayerTreeView::layoutViewportSize):
+        (WebKit):
+        (WebKit::WebLayerTreeView::deviceViewportSize):
+        (WebKit::WebLayerTreeView::setDeviceScaleFactor):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::paint):
+        (WebKit::WebViewImpl::updateLayerTreeViewport):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        V8Proxy::currentContext() doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=93041
+
+        Reviewed by Eric Seidel.
+
+        * src/WebBindings.cpp:
+        (WebKit::makeIntArrayImpl):
+        (WebKit::makeStringArrayImpl):
+
+2012-08-02  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: Core upgradeneeded logic
+        https://bugs.webkit.org/show_bug.cgi?id=92558
+
+        Reviewed by Ojan Vafai.
+
+        Update overridden methods to match new signatures.
+
+        * tests/IDBAbortOnCorruptTest.cpp:
+        (WebCore::FailingBackingStore::createIDBDatabaseMetaData):
+        * tests/IDBFakeBackingStore.h:
+
+2012-08-02  Vincent Scheib  <scheib@chromium.org>
+
+        Remove old Pointer Lock API.
+        https://bugs.webkit.org/show_bug.cgi?id=88892
+
+        Reviewed by Adam Barth.
+
+        * src/WebViewImpl.cpp:
+            Removed #include to old API header.
+
+2012-08-02  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Add CCScrollbarAnimationController class for compositor scrollbar animation
+        https://bugs.webkit.org/show_bug.cgi?id=91688
+
+        Reviewed by Adrienne Walker.
+
+        New unit test ScrollbarLayerChromiumTest.scrollOffsetSynchronization to verify
+        scroll offset is updated during tree synchronization and threaded scrolling.
+        Another new unit test CCScrollbarAnimationControllerLinearFadeTest to verify
+        opacity animates as intended.
+
+        * tests/ScrollbarLayerChromiumTest.cpp:
+
+2012-08-02  Adrienne Walker  <enne@google.com>
+
+        [chromium] Make CCScrollbarLayerImpl handle lost contexts properly
+        https://bugs.webkit.org/show_bug.cgi?id=93021
+
+        Reviewed by James Robinson.
+
+        Add CCScrollbarLayerImpl to the dontUseOldResourceAfterLostContext
+        test. Additionally, modify this test so that stale resource ids
+        properly point at invalid texture ids so that the test actually tests
+        what it is supposed to be testing.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        The generic bindings shouldn't use templates
+        https://bugs.webkit.org/show_bug.cgi?id=93016
+
+        Reviewed by Eric Seidel.
+
+        Update #include.
+
+        * src/WebBindings.cpp:
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Add a stub for WebView::getTouchHighlightQuads()
+        https://bugs.webkit.org/show_bug.cgi?id=92997
+
+        Reviewed by Adam Barth.
+
+        Chrome on Android will be using this method for the link preview
+        implementation, discussion about which is available in Bug 79150. Since
+        that system is fairly big, will require refactoring, and the unavailable
+        APIs are blocking API compatibility, add a stub for now.
+
+        Together with the WebView API, also add the "WebTouchCandidatesInfo"
+        structure which is being used by it.
+
+        * public/WebView.h:
+        (WebKit):
+        (WebView):
+        * src/WebViewImpl.cpp:
+        (WebKit):
+        (WebKit::WebViewImpl::getTouchHighlightQuads):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-08-02  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Fire speech start event at the same time as sound start event
+        https://bugs.webkit.org/show_bug.cgi?id=92971
+
+        Reviewed by Adam Barth.
+
+        Chromium's speech recognizer doesn't differentiate between "sound
+        started" and "speech started". Just fire those events at the same
+        time, and don't provide functions for them in
+        WebSpeechRecognizerClient.
+
+        * public/WebSpeechRecognizerClient.h:
+        * src/SpeechRecognitionClientProxy.cpp:
+        (WebKit::SpeechRecognitionClientProxy::didStartSound):
+        (WebKit::SpeechRecognitionClientProxy::didEndSound):
+        * src/SpeechRecognitionClientProxy.h:
+        (SpeechRecognitionClientProxy):
+
+2012-08-02  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] WebViewImpl::showTouchHighlightQuads isn't needed for Android
+        https://bugs.webkit.org/show_bug.cgi?id=92921
+
+        Reviewed by Nate Chapin.
+
+        We originally added a stub implementation of this function to make
+        merging detectContentOnTouch easier, but showTouchHighlightQuads is
+        being removed from the chromium-android branch in favor of the code in
+        https://bugs.webkit.org/show_bug.cgi?id=84487. This patch removes the
+        stub.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::detectContentIntentOnTouch):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Toggle the type of ant compile for webkit_unit_tests and TestWebKitAPI
+        https://bugs.webkit.org/show_bug.cgi?id=92858
+
+        Reviewed by Adam Barth.
+
+        Now that the sdk_build variable is available, we can remove these two differences
+        as well. This goes together with Adam's bug 90920.
+
+        After this patch, the whole Tools/ directory will be unforked :-).
+
+        * WebKitUnitTests.gyp:
+
+2012-08-02  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: count RenderStyle objects in the native memory profiler
+        https://bugs.webkit.org/show_bug.cgi?id=91759
+
+        Reviewed by Yury Semikhatsky.
+
+        Add a test for DataRef<T> wrapped member instrumentation.
+
+        * tests/MemoryInstrumentationTest.cpp:
+        (WebCore::InstrumentedRefPtr::create):
+        (WebCore::TEST):
+        (WebCore):
+
+2012-08-02  Peter Beverloo  <peter@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: test native memory instrumentation code with help of unittests
+        https://bugs.webkit.org/show_bug.cgi?id=92743
+
+        Reviewed by Yury Semikhatsky.
+
+        Test a part of existing Native Memory Instrumentation code with help of unit tests.
+        6 tests were added and two bugs were fixed.
+        a drive-by improvement: the method MemoryInstrumentation::addInstrumentedObject
+        was marked as private and addRootObject was introduced instead of it.
+        The new function also calls processDeferedPointers.
+
+        * WebKit.gypi:
+        * tests/MemoryInstrumentationTest.cpp: Added.
+        (WebCore):
+        (NotInstrumented):
+        (Instrumented):
+        (WebCore::Instrumented::Instrumented):
+        (WebCore::Instrumented::~Instrumented):
+        (WebCore::Instrumented::reportMemoryUsage):
+        (WebCore::TEST):
+        (InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+
+2012-08-01  Xingnan Wang  <xingnan.wang@intel.com>
+
+        IndexedDB: ObjectStoreMetaDataKey::m_metaDataType should use byte type
+        https://bugs.webkit.org/show_bug.cgi?id=92725
+
+        Reviewed by Kentaro Hara.
+
+        Add two new tests in IDBLevelDBCodingTest.cpp. One for an added function decodeByte() and 
+        another for verifying that encodeByte() and encodeVarInt() are indentical when the encoded 
+        values are <= 127.
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+        (IDBLevelDBCoding):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use new-style tracing macros with explicit category
+        https://bugs.webkit.org/show_bug.cgi?id=92928
+
+        Reviewed by Adam Barth.
+
+        Set the category explicitly in traces.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::updateAnimations):
+        (WebKit::WebViewImpl::layout):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-08-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move compositor HUD font atlas initialization code out of compositor core
+        https://bugs.webkit.org/show_bug.cgi?id=92924
+
+        Reviewed by Adrienne Walker.
+
+        This initializes the compositor's font atlas when initialization the compositor if the "Show FPS counter" or
+        "Show layer tree" settings are true.
+
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::setFontAtlas):
+        (WebKit):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        [chromium] Make WebKit API support draggable region change update
+        https://bugs.webkit.org/show_bug.cgi?id=92813
+
+        Reviewed by Adam Barth.
+
+        Introduce WebDraggableRegion and delegate the draggable region update
+        call to the new method draggableRegionsChanged in WebViewClient.
+
+        * public/WebDocument.h:
+        (WebDocument):
+        * public/WebDraggableRegion.h: Added.
+        (WebKit):
+        (WebDraggableRegion):
+        * public/WebViewClient.h:
+        (WebViewClient):
+        (WebKit::WebViewClient::draggableRegionsChanged):
+        * src/ChromeClientImpl.cpp:
+        (WebKit):
+        (WebKit::ChromeClientImpl::dashboardRegionsChanged):
+        * src/ChromeClientImpl.h:
+        (ChromeClientImpl):
+        * src/WebDocument.cpp:
+        (WebKit::WebDocument::draggableRegions):
+        (WebKit):
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] factor out the optimization pass in CCRenderSurfaceFilters::apply
+        https://bugs.webkit.org/show_bug.cgi?id=92453
+
+        Reviewed by James Robinson.
+
+        This separates the "optimization" pass in CCRenderSurfaceFilters::apply
+        to resolve a succession of color matrix filters into a single operation.
+        This allows testing of that code.
+        This introduces a new generic color matrix WebFilterOperation, which can
+        also be used on its own.
+
+        * WebKit.gypi:
+        * tests/CCRenderSurfaceFiltersTest.cpp: Added.
+        (WebKit):
+        (WebKit::isCombined):
+        (WebKit::TEST):
+
+2012-08-01  Daniel Murphy  <dmurph@chromium.org>
+
+        Fix for drawing invalid layers in WebViewBenchmarkSupportImpl
+        https://bugs.webkit.org/show_bug.cgi?id=92920
+
+        Reviewed by Adrienne Walker.
+
+        The GraphicsLayers without content needed to be skipped.
+
+        * src/WebViewBenchmarkSupportImpl.cpp:
+        (WebKit::WebViewBenchmarkSupportImpl::acceleratedPaintUnclipped):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * features.gypi: Add ENABLE_WIDGET_REGION define.
+
+2012-08-01  Antoine Labour  <piman@chromium.org>
+
+        [chromium] Fix lost context handling on hud layer
+        https://bugs.webkit.org/show_bug.cgi?id=92915
+
+        Reviewed by Adrienne Walker.
+
+        On lost context we need to release CCScopedTextures, otherwise later on
+        we will try to re-allocate it using a stale CCResourceProvider.
+
+        Test CCLayerTreeHostImplTest.dontUseOldResourcesAfterLostContext
+        extended.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-08-01  Nico Weber  <thakis@chromium.org>
+
+        [chromium/mac] Delete WebImageCG.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=92910
+
+        Reviewed by James Robinson.
+
+        It's been unused since the switch to skia.
+        Also remove now-unneeded *CG.cpp exclusion rule.
+
+        * WebKit.gyp:
+        * src/WebImageCG.cpp: Removed.
+
+2012-08-01  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: API stubs to simplify WebIDBCursor API
+        https://bugs.webkit.org/show_bug.cgi?id=92414
+
+        Reviewed by Adam Barth.
+
+        Prep work to unblock Chromium changes so that http://webkit.org/b/92278 can land.
+        Adds no-op methods which will later be implemented; during the landing sequence,
+        Chromium will call both the new methods and the old ones. The end goal is that
+        the success callbacks for cursors will include the new key/primaryKey/value rather
+        than requiring the callee to call back into the cursor backend to fetch them.
+
+        * public/WebIDBCallbacks.h:
+        (WebIDBCallbacks):
+        (WebKit::WebIDBCallbacks::onSuccess):
+
+2012-08-01  Peter Beverloo  <peter@chromium.org>
+
+        [Text Autosizing] Provide an API for influencing the font scale factor
+        https://bugs.webkit.org/show_bug.cgi?id=92882
+
+        Reviewed by Adam Barth.
+
+        Add an API to change Text Autosizing's font scale factor.
+
+        The font scale factor applied to Text Autosizing influences the sizing
+        of text, and will influence the scaling of boosted blocks once the
+        implementation progresses. For Android, it will be set to the font size
+        chosen in the user's system-wide preferences.
+
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setTextAutosizingFontScaleFactor):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-08-01  Dirk Pranke  <dpranke@chromium.org>
+
+        Roll chromium DEPS to 149416.
+
+        Unreviewed.
+
+        * DEPS:
+
+2012-08-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124334.
+        http://trac.webkit.org/changeset/124334
+        https://bugs.webkit.org/show_bug.cgi?id=92879
+
+        Broke MemoryInstrumentationTest.sizeOf from webkit_unit_tests
+        on Chromium canaries (Requested by apavlov1 on #webkit).
+
+        * WebKit.gypi:
+        * tests/MemoryInstrumentationTest.cpp: Removed.
+
+2012-08-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: test native memory instrumentation code with help of unittests
+        https://bugs.webkit.org/show_bug.cgi?id=92743
+
+        Reviewed by Yury Semikhatsky.
+
+        Test a part of existing Native Memory Instrumentation code with help of unit tests.
+        6 tests were added and two bugs were fixed.
+
+        * WebKit.gypi:
+        * tests/MemoryInstrumentationTest.cpp: Added.
+        (WebCore):
+        (MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::MemoryInstrumentationImpl):
+        (WebCore::MemoryInstrumentationImpl::reportedSize):
+        (WebCore::MemoryInstrumentationImpl::countObjectSize):
+        (WebCore::MemoryInstrumentationImpl::processDeferredInstrumentedPointers):
+        (NotInstrumented):
+        (Instrumented):
+        (WebCore::Instrumented::Instrumented):
+        (WebCore::Instrumented::~Instrumented):
+        (WebCore::Instrumented::reportMemoryUsage):
+        (WebCore::TEST):
+        (InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::InstrumentedWithOwnPtr):
+        (WebCore::InstrumentedWithOwnPtr::reportMemoryUsage):
+
+2012-08-01  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: count DOM storage cache memory for native snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=91617
+
+        Reviewed by Yury Semikhatsky.
+
+        Add memory size used for DOM storage cache reporting interface.
+
+        * src/StorageAreaProxy.cpp:
+        (WebCore::StorageAreaProxy::memoryBytesUsedByCache):
+        (WebCore):
+        * src/StorageAreaProxy.h:
+        (StorageAreaProxy):
+
+2012-07-31  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium] Enable ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS
+        https://bugs.webkit.org/show_bug.cgi?id=92822
+
+        Reviewed by Kent Tamura.
+
+        This patch enables ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS for Chromium
+        port except for Android.
+
+        * features.gypi: Add ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS=1 to "feature_defines"
+        block of OS != "android".
+
+2012-07-31  Yusuf Ozuysal  <yusufo@google.com>
+
+        [chromium]Upstream WebViewImpl:StartPageScaleAnimation changes for Chrome for Android
+        https://bugs.webkit.org/show_bug.cgi?id=92698
+
+        Reviewed by Adam Barth.
+
+        Enforce the maximum and minimum scroll positions after the scale has changed.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::startPageScaleAnimation):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-07-31  Terry Anderson  <tdanderson@chromium.org>
+
+        [chromium] Use the event bounding box when constructing a PlatformEvent::GestureTap
+        https://bugs.webkit.org/show_bug.cgi?id=92151
+
+        Reviewed by Darin Fisher.
+
+        Now that gesture events store a bounding box, use |boundingBox| instead of
+        |deltaX| and |deltaY| when specifying |m_area|.
+
+        * public/WebInputEvent.h:
+        (WebGestureEvent):
+        * src/WebInputEventConversion.cpp:
+        (WebKit::PlatformGestureEventBuilder::PlatformGestureEventBuilder):
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-31  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Hit test points are being clipped by layers that should not clip
+        https://bugs.webkit.org/show_bug.cgi?id=92786
+
+        Reviewed by James Robinson.
+
+        * tests/CCLayerTreeHostCommonTest.cpp: adds a test where the
+          hit-testable layer does not overlap its parent. The parent does
+          not clip, so the layer should still be hittable.
+
+2012-07-31  Chris Rogers  <crogers@google.com>
+
+        Allow AudioDestination to support local/live audio input
+        https://bugs.webkit.org/show_bug.cgi?id=90318
+
+        Reviewed by Kenneth Russell.
+
+        * src/AudioDestinationChromium.cpp:
+        (WebCore::AudioDestination::create):
+        (WebCore::AudioDestinationChromium::AudioDestinationChromium):
+        (WebCore::AudioDestinationChromium::provideInput):
+        (WebCore):
+        * src/AudioDestinationChromium.h:
+        (AudioDestinationChromium):
+
+2012-07-31  Adam Barth  <abarth@webkit.org>
+
+        [Chromium-Android] We should hueristically detect content intents on touch
+        https://bugs.webkit.org/show_bug.cgi?id=92346
+
+        Reviewed by Nate Chapin.
+
+        On Android, when the user touches a block of text, we run a bunch of
+        OS-provided hueristics to detect content intents, such as telephone
+        numbers and mailing addresses.
+
+        This patch introduces the WebViewClient functions and the
+        detectContentIntentOnTouch function, but does not wire the code into
+        the event system. There are some decisions to make about how to wire it
+        into the event system, we'll tackle in the next patch.
+
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::detectContentIntentAround):
+        (WebViewClient):
+        (WebKit::WebViewClient::scheduleContentIntent):
+        (WebKit::WebViewClient::cancelScheduledContentIntents):
+        * src/WebViewImpl.cpp:
+        (WebKit):
+        (WebKit::tapHighlightColorForNode):
+        (WebKit::WebViewImpl::showTouchHighlightQuads):
+        (WebKit::WebViewImpl::detectContentIntentOnTouch):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-07-31  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Use WebAnimation and related classes in GraphicsLayerChromium and AnimTranslationUtil
+        https://bugs.webkit.org/show_bug.cgi?id=90468
+
+        Reviewed by James Robinson.
+
+        * src/WebAnimation.cpp:
+        (WebKit::WebAnimation::targetProperty):
+        (WebKit):
+        (WebKit::WebAnimation::initialize):
+        * src/WebLayer.cpp:
+        (WebKit::WebLayer::setAnimationDelegate):
+        (WebKit):
+        (WebKit::WebLayer::addAnimation):
+        (WebKit::WebLayer::removeAnimation):
+        (WebKit::WebLayer::pauseAnimation):
+        (WebKit::WebLayer::suspendAnimations):
+        (WebKit::WebLayer::resumeAnimations):
+        (WebKit::WebLayer::transferAnimationsTo):
+        * tests/CCThreadedTest.cpp:
+        * tests/CCThreadedTest.h:
+        (TestHooks):
+        * tests/WebAnimationTest.cpp:
+        (WebKit::TEST):
+
+2012-07-30  Adam Barth  <abarth@webkit.org>
+
+        Typo: doubleTa*b*ZoomAnimationDurationInSeconds in WebViewImpl.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=92135
+
+        Reviewed by Kentaro Hara.
+
+        This patch fixes a typo.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::animateZoomAroundPoint):
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124179.
+        http://trac.webkit.org/changeset/124179
+        https://bugs.webkit.org/show_bug.cgi?id=92730
+
+        Breaks Chromium Linux 32 bots with "error: integer constant is
+        too large for 'long' type" in IDBLevelDBCodingTest.cpp
+        (Requested by apavlov on #webkit).
+
+        * tests/IDBLevelDBCodingTest.cpp:
+        (IDBLevelDBCoding::TEST):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Integrated ColorChooserProxy and WebColorChooserClientImpl into ColorChooserUIController.
+        ColorChooserUIController can control whether to open the color suggestion picker
+        popup or the color chooser depending on the responses from ColorChooserClient.
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser): Returns ColorChooserUIController which is a ColorChooser.
+        (WebKit::ChromeClientImpl::createWebColorChooser): Returns WebColorChooser that was created by Chromium.
+        * src/ChromeClientImpl.h:
+        (WebKit):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Removed.
+        * src/ColorChooserProxy.h: Removed.
+        * src/ColorChooserUIController.cpp: Added.
+        (WebKit):
+        (WebKit::ColorChooserUIController::ColorChooserUIController): Controls the UI for color chooser. Opens the color suggestion picker popup or color chooser depending on the ColorChooserClient.
+        (WebKit::ColorChooserUIController::~ColorChooserUIController):
+        (WebKit::ColorChooserUIController::setSelectedColor):
+        (WebKit::ColorChooserUIController::endChooser): This is called by WebCore so we close both the popup and the color chooser.
+        (WebKit::ColorChooserUIController::didChooseColor):
+        (WebKit::ColorChooserUIController::didEndChooser):
+        (WebKit::ColorChooserUIController::contentSize): The popup will be resized later from JS so we return an arbitrary size.
+        (WebKit::ColorChooserUIController::writeDocument):
+        (WebKit::ColorChooserUIController::setValueAndClosePopup): Performs action based on the numValue.
+        (WebKit::ColorChooserUIController::didClosePopup):
+        (WebKit::ColorChooserUIController::openPopup): Opens color chooser suggestion popup.
+        (WebKit::ColorChooserUIController::closePopup):
+        (WebKit::ColorChooserUIController::openColorChooser): Opens color chooser.
+        * src/ColorChooserUIController.h: Renamed from Source/WebKit/chromium/src/WebColorChooserClientImpl.h.
+        (WebCore):
+        (WebKit):
+        (ColorChooserUIController):
+        * src/WebColorChooserClientImpl.cpp: Removed.
+
+2012-07-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Roll out the DEPS roll (r124164) for now since it broke Chromium Mac builds.
+
+        * DEPS:
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Wrap ScrollbarLayerChromium in WebScrollbarLayer
+        https://bugs.webkit.org/show_bug.cgi?id=91032
+
+        Reviewed by James Robinson.
+
+        Add implementation of WebScrollbarLayer to the client API.
+
+        * WebKit.gyp:
+        * src/WebScrollbarLayer.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarLayer::setScrollLayer):
+        (WebKit::WebScrollbarLayer::create):
+        (WebKit::WebScrollbarLayer::WebScrollbarLayer):
+        (WebKit::WebScrollbarLayer::operator=):
+        (WebKit::WebScrollbarLayer::operator PassRefPtr<ScrollbarLayerChromium>):
+
+2012-07-30  Sadrul Habib Chowdhury  <sadrul@chromium.org>
+
+        Propagate gesture events to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=92281
+
+        Reviewed by Adam Barth.
+
+        Propagate gesture events to plugins.
+
+        * src/WebInputEventConversion.cpp:
+        (WebKit):
+        (WebKit::WebGestureEventBuilder::WebGestureEventBuilder):
+        * src/WebInputEventConversion.h:
+        (WebCore):
+        (WebKit):
+        (WebGestureEventBuilder):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::handleEvent):
+        * src/WebPluginContainerImpl.h:
+        (WebCore):
+        (WebPluginContainerImpl):
+
+2012-07-30  John Bates  <jbates@google.com>
+
+        Plumb vsync-enabled flag up to compositor thread and support disable-vsync
+        https://bugs.webkit.org/show_bug.cgi?id=92323
+
+        Reviewed by James Robinson.
+
+        * public/WebSettings.h:
+        * tests/CCFrameRateControllerTest.cpp:
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::Settings::operator CCLayerTreeSettings):
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::WebSettingsImpl):
+        (WebKit::WebSettingsImpl::setRenderVSyncEnabled):
+        (WebKit):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        (WebKit::WebSettingsImpl::renderVSyncEnabled):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2012-07-30  Adrienne Walker  <enne@google.com>
+
+        [chromium] Remove dependency on ScrollbarTheme from the compositor
+        https://bugs.webkit.org/show_bug.cgi?id=90528
+
+        Reviewed by James Robinson.
+
+        Add implementations for WebScrollbarThemeGeometry and
+        WebScrollbarThemePainter. Fill out additional API calls for
+        WebPluginScrollbarImpl since it derives from WebScrollbar.
+
+        Add WebScrollbarImpl to the client API to wrap and own an existing
+        WebCore Scrollbar object and provide the WebScrollbar interface.
+
+        By keeping WebScrollbar separate from WebScrollbarThemeGeometry, the
+        compositor thread can create its own thread-safe data bag version of a
+        WebScrollbar (CCScrollbarLayerImpl::CCScrollbar), but this requires
+        WebScrollbarThemeClientImpl.
+
+        WebScrollbarThemeClientImpl does the reverse of WebScrollbarImpl; it
+        wraps a WebScrollbar and provides the ScrollbarThemeClient interface.
+        This is so that a WebScrollbar can be passed to the geometry and
+        painter functions. Then, internally the WebScrollbarThemeClientImpl
+        can be used to adapt the WebScrollbar to the ScrollbarThemeClient
+        interface so the geometry and painter functions can call direct
+        functions on ScrollbarThemeComposite.
+
+        * WebKit.gyp:
+        * src/AssertMatchingEnums.cpp:
+        * src/ExternalPopupMenu.h:
+        (WebKit):
+        * src/WebPluginScrollbarImpl.cpp:
+        (WebKit::WebPluginScrollbarImpl::WebPluginScrollbarImpl):
+        (WebKit::WebPluginScrollbarImpl::location):
+        (WebKit):
+        (WebKit::WebPluginScrollbarImpl::size):
+        (WebKit::WebPluginScrollbarImpl::enabled):
+        (WebKit::WebPluginScrollbarImpl::maximum):
+        (WebKit::WebPluginScrollbarImpl::totalSize):
+        (WebKit::WebPluginScrollbarImpl::isScrollViewScrollbar):
+        (WebKit::WebPluginScrollbarImpl::isScrollableAreaActive):
+        (WebKit::WebPluginScrollbarImpl::getTickmarks):
+        (WebKit::WebPluginScrollbarImpl::controlSize):
+        (WebKit::WebPluginScrollbarImpl::pressedPart):
+        (WebKit::WebPluginScrollbarImpl::hoveredPart):
+        (WebKit::WebPluginScrollbarImpl::scrollbarOverlayStyle):
+        (WebKit::WebPluginScrollbarImpl::orientation):
+        (WebKit::WebPluginScrollbarImpl::isCustomScrollbar):
+        (WebKit::WebPluginScrollbarImpl::onMouseUp):
+        (WebKit::WebPluginScrollbarImpl::onMouseMove):
+        (WebKit::WebPluginScrollbarImpl::onMouseLeave):
+        * src/WebPluginScrollbarImpl.h:
+        (WebPluginScrollbarImpl):
+        * src/WebScrollbarImpl.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbar::create):
+        (WebKit::WebScrollbarImpl::WebScrollbarImpl):
+        (WebKit::WebScrollbarImpl::isOverlay):
+        (WebKit::WebScrollbarImpl::value):
+        (WebKit::WebScrollbarImpl::location):
+        (WebKit::WebScrollbarImpl::size):
+        (WebKit::WebScrollbarImpl::enabled):
+        (WebKit::WebScrollbarImpl::maximum):
+        (WebKit::WebScrollbarImpl::totalSize):
+        (WebKit::WebScrollbarImpl::isScrollViewScrollbar):
+        (WebKit::WebScrollbarImpl::isScrollableAreaActive):
+        (WebKit::WebScrollbarImpl::getTickmarks):
+        (WebKit::WebScrollbarImpl::controlSize):
+        (WebKit::WebScrollbarImpl::pressedPart):
+        (WebKit::WebScrollbarImpl::hoveredPart):
+        (WebKit::WebScrollbarImpl::scrollbarOverlayStyle):
+        (WebKit::WebScrollbarImpl::orientation):
+        (WebKit::WebScrollbarImpl::isCustomScrollbar):
+        * src/WebScrollbarImpl.h: Copied from Source/Platform/chromium/public/WebScrollbar.h.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarImpl):
+        * src/WebScrollbarThemeClientImpl.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarThemeClientImpl::WebScrollbarThemeClientImpl):
+        (WebKit::WebScrollbarThemeClientImpl::x):
+        (WebKit::WebScrollbarThemeClientImpl::y):
+        (WebKit::WebScrollbarThemeClientImpl::width):
+        (WebKit::WebScrollbarThemeClientImpl::height):
+        (WebKit::WebScrollbarThemeClientImpl::size):
+        (WebKit::WebScrollbarThemeClientImpl::location):
+        (WebKit::WebScrollbarThemeClientImpl::parent):
+        (WebKit::WebScrollbarThemeClientImpl::root):
+        (WebKit::WebScrollbarThemeClientImpl::setFrameRect):
+        (WebKit::WebScrollbarThemeClientImpl::frameRect):
+        (WebKit::WebScrollbarThemeClientImpl::invalidate):
+        (WebKit::WebScrollbarThemeClientImpl::invalidateRect):
+        (WebKit::WebScrollbarThemeClientImpl::scrollbarOverlayStyle):
+        (WebKit::WebScrollbarThemeClientImpl::getTickmarks):
+        (WebKit::WebScrollbarThemeClientImpl::isScrollableAreaActive):
+        (WebKit::WebScrollbarThemeClientImpl::isScrollViewScrollbar):
+        (WebKit::WebScrollbarThemeClientImpl::convertFromContainingWindow):
+        (WebKit::WebScrollbarThemeClientImpl::isCustomScrollbar):
+        (WebKit::WebScrollbarThemeClientImpl::orientation):
+        (WebKit::WebScrollbarThemeClientImpl::value):
+        (WebKit::WebScrollbarThemeClientImpl::currentPos):
+        (WebKit::WebScrollbarThemeClientImpl::visibleSize):
+        (WebKit::WebScrollbarThemeClientImpl::totalSize):
+        (WebKit::WebScrollbarThemeClientImpl::maximum):
+        (WebKit::WebScrollbarThemeClientImpl::controlSize):
+        (WebKit::WebScrollbarThemeClientImpl::lineStep):
+        (WebKit::WebScrollbarThemeClientImpl::pageStep):
+        (WebKit::WebScrollbarThemeClientImpl::pressedPart):
+        (WebKit::WebScrollbarThemeClientImpl::hoveredPart):
+        (WebKit::WebScrollbarThemeClientImpl::styleChanged):
+        (WebKit::WebScrollbarThemeClientImpl::enabled):
+        (WebKit::WebScrollbarThemeClientImpl::setEnabled):
+        (WebKit::WebScrollbarThemeClientImpl::isOverlayScrollbar):
+        * src/WebScrollbarThemeClientImpl.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarThemeClientImpl):
+        * src/WebScrollbarThemeGeometry.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarThemeGeometry::assign):
+        (WebKit::WebScrollbarThemeGeometry::thumbPosition):
+        (WebKit::WebScrollbarThemeGeometry::thumbLength):
+        (WebKit::WebScrollbarThemeGeometry::trackPosition):
+        (WebKit::WebScrollbarThemeGeometry::trackLength):
+        (WebKit::WebScrollbarThemeGeometry::hasButtons):
+        (WebKit::WebScrollbarThemeGeometry::hasThumb):
+        (WebKit::WebScrollbarThemeGeometry::trackRect):
+        (WebKit::WebScrollbarThemeGeometry::thumbRect):
+        (WebKit::WebScrollbarThemeGeometry::minimumThumbLength):
+        (WebKit::WebScrollbarThemeGeometry::scrollbarThickness):
+        (WebKit::WebScrollbarThemeGeometry::backButtonStartRect):
+        (WebKit::WebScrollbarThemeGeometry::backButtonEndRect):
+        (WebKit::WebScrollbarThemeGeometry::forwardButtonStartRect):
+        (WebKit::WebScrollbarThemeGeometry::forwardButtonEndRect):
+        (WebKit::WebScrollbarThemeGeometry::constrainTrackRectToTrackPieces):
+        (WebKit::WebScrollbarThemeGeometry::splitTrack):
+        (WebKit::WebScrollbarThemeGeometry::WebScrollbarThemeGeometry):
+        * src/WebScrollbarThemePainter.cpp: Added.
+        (WebKit):
+        (WebKit::WebScrollbarThemePainter::assign):
+        (WebKit::WebScrollbarThemePainter::paintScrollbarBackground):
+        (WebKit::WebScrollbarThemePainter::paintTrackBackground):
+        (WebKit::WebScrollbarThemePainter::paintBackTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintForwardTrackPart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintBackButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonStart):
+        (WebKit::WebScrollbarThemePainter::paintForwardButtonEnd):
+        (WebKit::WebScrollbarThemePainter::paintTickmarks):
+        (WebKit::WebScrollbarThemePainter::paintThumb):
+        (WebKit::WebScrollbarThemePainter::WebScrollbarThemePainter):
+        * tests/ScrollbarLayerChromiumTest.cpp:
+        (WebCore::MockScrollbar::convertFromContainingWindow):
+        (WebCore::MockScrollbar::isOverlayScrollbar):
+        (MockScrollbar):
+        (WebCore::TEST):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124025.
+        http://trac.webkit.org/changeset/124025
+        https://bugs.webkit.org/show_bug.cgi?id=92658
+
+        Causes color-suggestion-picker-appearance layout test to time
+        out on all Chromium platforms (Requested by tomhudson_ on
+        #webkit).
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser):
+        * src/ChromeClientImpl.h:
+        (WebCore):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::ColorChooserProxy::ColorChooserProxy):
+        (WebKit::ColorChooserProxy::~ColorChooserProxy):
+        (WebKit::ColorChooserProxy::setSelectedColor):
+        (WebKit::ColorChooserProxy::endChooser):
+        * src/ColorChooserProxy.h: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (ColorChooserProxy):
+        * src/ColorChooserUIController.cpp: Removed.
+        * src/WebColorChooserClientImpl.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::WebColorChooserClientImpl::WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::~WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::didChooseColor):
+        (WebKit::WebColorChooserClientImpl::didEndChooser):
+        * src/WebColorChooserClientImpl.h: Renamed from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebCore):
+        (WebKit):
+        (WebColorChooserClientImpl):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Integrated ColorChooserProxy and WebColorChooserClientImpl into ColorChooserUIController.
+        ColorChooserUIController can control whether to open the color suggestion picker
+        popup or the color chooser depending on the responses from ColorChooserClient.
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser): Returns ColorChooserUIController which is a ColorChooser.
+        (WebKit::ChromeClientImpl::createWebColorChooser): Returns WebColorChooser that was created by Chromium.
+        * src/ChromeClientImpl.h:
+        (WebKit):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Removed.
+        * src/ColorChooserProxy.h: Removed.
+        * src/ColorChooserUIController.cpp: Added.
+        (WebKit):
+        (WebKit::ColorChooserUIController::ColorChooserUIController): Controls the UI for color chooser. Opens the color suggestion picker popup or color chooser depending on the ColorChooserClient.
+        (WebKit::ColorChooserUIController::~ColorChooserUIController):
+        (WebKit::ColorChooserUIController::setSelectedColor):
+        (WebKit::ColorChooserUIController::endChooser): This is called by WebCore so we close both the popup and the color chooser.
+        (WebKit::ColorChooserUIController::didChooseColor):
+        (WebKit::ColorChooserUIController::didEndChooser):
+        (WebKit::ColorChooserUIController::contentSize): The popup will be resized later from JS so we return an arbitrary size.
+        (WebKit::ColorChooserUIController::writeDocument):
+        (WebKit::ColorChooserUIController::setValueAndClosePopup): Performs action based on the numValue.
+        (WebKit::ColorChooserUIController::didClosePopup):
+        (WebKit::ColorChooserUIController::openPopup): Opens color chooser suggestion popup.
+        (WebKit::ColorChooserUIController::closePopup):
+        (WebKit::ColorChooserUIController::openColorChooser): Opens color chooser.
+        * src/ColorChooserUIController.h: Renamed from Source/WebKit/chromium/src/WebColorChooserClientImpl.h.
+        (WebCore):
+        (WebKit):
+        (ColorChooserUIController):
+        * src/WebColorChooserClientImpl.cpp: Removed.
+
+2012-07-30  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        [DRT] LTC:: pageNumberForElementById() could be moved to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=92091
+
+        Reviewed by Hajime Morita.
+
+        Move the pageNumberForElementById from LayoutTestCotroller to Internals and
+        remove the old platform specific implementations as it exclusively tests WebCore functionality.
+
+        * public/WebFrame.h:
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        (WebKit):
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124004.
+        http://trac.webkit.org/changeset/124004
+        https://bugs.webkit.org/show_bug.cgi?id=92622
+
+        Broke Android build (Requested by keishi on #webkit).
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser):
+        * src/ChromeClientImpl.h:
+        (WebCore):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::ColorChooserProxy::ColorChooserProxy):
+        (WebKit::ColorChooserProxy::~ColorChooserProxy):
+        (WebKit::ColorChooserProxy::setSelectedColor):
+        (WebKit::ColorChooserProxy::endChooser):
+        * src/ColorChooserProxy.h: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (ColorChooserProxy):
+        * src/ColorChooserUIController.cpp: Removed.
+        * src/WebColorChooserClientImpl.cpp: Copied from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebKit):
+        (WebKit::WebColorChooserClientImpl::WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::~WebColorChooserClientImpl):
+        (WebKit::WebColorChooserClientImpl::didChooseColor):
+        (WebKit::WebColorChooserClientImpl::didEndChooser):
+        * src/WebColorChooserClientImpl.h: Renamed from Source/WebKit/chromium/src/ColorChooserUIController.h.
+        (WebCore):
+        (WebKit):
+        (WebColorChooserClientImpl):
+
+2012-07-30  Keishi Hattori  <keishi@webkit.org>
+
+        Implement datalist UI for input type color for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=92075
+
+        Reviewed by Kent Tamura.
+
+        Integrated ColorChooserProxy and WebColorChooserClientImpl into ColorChooserUIController.
+        ColorChooserUIController can control whether to open the color suggestion picker
+        popup or the color chooser depending on the responses from ColorChooserClient.
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::createColorChooser): Returns ColorChooserUIController which is a ColorChooser.
+        (WebKit::ChromeClientImpl::createWebColorChooser): Returns WebColorChooser that was created by Chromium.
+        * src/ChromeClientImpl.h:
+        (WebKit):
+        (ChromeClientImpl):
+        * src/ColorChooserProxy.cpp: Removed.
+        * src/ColorChooserProxy.h: Removed.
+        * src/ColorChooserUIController.cpp: Added.
+        (WebKit):
+        (WebKit::ColorChooserUIController::ColorChooserUIController): Controls the UI for color chooser. Opens the color suggestion picker popup or color chooser depending on the ColorChooserClient.
+        (WebKit::ColorChooserUIController::~ColorChooserUIController):
+        (WebKit::ColorChooserUIController::setSelectedColor):
+        (WebKit::ColorChooserUIController::endChooser): This is called by WebCore so we close both the popup and the color chooser.
+        (WebKit::ColorChooserUIController::didChooseColor):
+        (WebKit::ColorChooserUIController::didEndChooser):
+        (WebKit::ColorChooserUIController::contentSize): The popup will be resized later from JS so we return an arbitrary size.
+        (WebKit::ColorChooserUIController::writeDocument):
+        (WebKit::ColorChooserUIController::setValueAndClosePopup): Performs action based on the numValue.
+        (WebKit::ColorChooserUIController::didClosePopup):
+        (WebKit::ColorChooserUIController::openPopup): Opens color chooser suggestion popup.
+        (WebKit::ColorChooserUIController::closePopup):
+        (WebKit::ColorChooserUIController::openColorChooser): Opens color chooser.
+        * src/ColorChooserUIController.h: Renamed from Source/WebKit/chromium/src/WebColorChooserClientImpl.h.
+        (WebCore):
+        (WebKit):
+        (ColorChooserUIController):
+        * src/WebColorChooserClientImpl.cpp: Removed.
+
 2012-07-29  Lu Guanqun  <guanqun.lu@intel.com>
 
         [chromium] pass acceleratePainting info to settings
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 2aabb4d59..3f938525d 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '148739'
+  'chromium_rev': '151128'
 }
 
 deps = {
@@ -87,6 +87,8 @@ deps = {
   # webkit dependencies
   'webkit': Var('chromium_svn')+'/webkit@'+Var('chromium_rev'),
 
+  'cc':
+    Var('chromium_svn')+'/cc@'+Var('chromium_rev'),
   'gpu':
     Var('chromium_svn')+'/gpu@'+Var('chromium_rev'),
   'ipc':
@@ -116,7 +118,7 @@ deps = {
   'tools/win':
     Var('chromium_svn')+'/tools/win@'+Var('chromium_rev'),
   'ui':
-    Var('chromium_svn')+'/ui@'+Var('chromium_rev'), # needed by app
+    Var('chromium_svn')+'/ui@'+Var('chromium_rev'),
 
   # other third party
   'third_party/pyftpdlib/src':
@@ -177,12 +179,14 @@ deps_os = {
       From('chromium_deps', 'src/third_party/openssl'),
   },
   'android': {
-    'tools/android':
-      Var('chromium_svn') + '/tools/android@' + Var('chromium_rev'),
-    'third_party/freetype':
-      From('chromium_deps', 'src/third_party/freetype'),
+    'third_party/android_tools':
+      From('chromium_deps', 'src/third_party/android_tools'),
     'third_party/aosp':
       From('chromium_deps', 'src/third_party/aosp'),
+    'third_party/freetype':
+      From('chromium_deps', 'src/third_party/freetype'),
+    'tools/android':
+      Var('chromium_svn') + '/tools/android@' + Var('chromium_rev'),
   },
 }
 
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index 45b949866..36ecf80f5 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -112,8 +112,6 @@
                 'public/WebColorName.h',
                 'public/WebCommonWorkerClient.h',
                 'public/WebCompositionUnderline.h',
-                'public/WebCompositor.h',
-                'public/WebCompositorClient.h',
                 'public/WebCompositorInputHandler.h',
                 'public/WebCompositorInputHandlerClient.h',
                 'public/WebConsoleMessage.h',
@@ -275,6 +273,7 @@
                 'public/WebTextInputType.h',
                 'public/WebTextRun.h',
                 'public/WebTimeRange.h',
+                'public/WebTouchCandidatesInfo.h',
                 'public/WebURLLoaderOptions.h',
                 'public/WebUserMediaClient.h',
                 'public/WebUserMediaRequest.h',
@@ -300,10 +299,7 @@
                 'public/platform/WebCanvas.h',
                 'public/platform/WebColor.h',
                 'public/platform/WebCommon.h',
-                'public/platform/WebContentLayer.h',
-                'public/platform/WebContentLayerClient.h',
                 'public/platform/WebData.h',
-                'public/platform/WebExternalTextureLayer.h',
                 'public/platform/WebFloatPoint.h',
                 'public/platform/WebFloatQuad.h',
                 'public/platform/WebFloatRect.h',
@@ -314,9 +310,6 @@
                 'public/platform/WebHTTPHeaderVisitor.h',
                 'public/platform/WebHTTPLoadInfo.h',
                 'public/platform/WebKitPlatformSupport.h',
-                'public/platform/WebLayer.h',
-                'public/platform/WebLayerTreeView.h',
-                'public/platform/WebLayerTreeViewClient.h',
                 'public/platform/WebNonCopyable.h',
                 'public/platform/WebPoint.h',
                 'public/platform/WebPrivateOwnPtr.h',
@@ -328,7 +321,6 @@
                 'public/platform/WebSocketStreamError.h',
                 'public/platform/WebSocketStreamHandle.h',
                 'public/platform/WebSocketStreamHandleClient.h',
-                'public/platform/WebSolidColorLayer.h',
                 'public/platform/WebString.h',
                 'public/platform/WebThread.h',
                 'public/platform/WebThreadSafeData.h',
@@ -363,15 +355,13 @@
                 'src/BatteryClientImpl.h',
                 'src/BlobRegistryProxy.cpp',
                 'src/BlobRegistryProxy.h',
-                'src/CCThreadImpl.cpp',
-                'src/CCThreadImpl.h',
                 'src/ChromeClientImpl.cpp',
                 'src/ChromeClientImpl.h',
-                'src/ColorChooserProxy.cpp',
-                'src/ColorChooserProxy.h',
                 'src/ChromiumCurrentTime.cpp',
                 'src/ChromiumOSRandomSource.cpp',
                 'src/ChromiumThreading.cpp',
+                'src/ColorChooserUIController.cpp',
+                'src/ColorChooserUIController.h',
                 'src/CompositionUnderlineBuilder.h',
                 'src/CompositionUnderlineVectorBuilder.cpp',
                 'src/CompositionUnderlineVectorBuilder.h',
@@ -489,12 +479,8 @@
                 'src/WebBlob.cpp',
                 'src/WebBlobData.cpp',
                 'src/WebCache.cpp',
-                'src/WebColorChooserClientImpl.cpp',
-                'src/WebColorChooserClientImpl.h',
                 'src/WebColorName.cpp',
                 'src/WebCommon.cpp',
-                'src/WebCompositorImpl.cpp',
-                'src/WebCompositorImpl.h',
                 'src/WebCompositorInputHandlerImpl.cpp',
                 'src/WebCompositorInputHandlerImpl.h',
                 'src/WebContentLayer.cpp',
@@ -576,7 +562,6 @@
                 'src/WebIDBTransactionCallbacksImpl.cpp',
                 'src/WebIDBTransactionCallbacksImpl.h',
                 'src/WebIOSurfaceLayer.cpp',
-                'src/WebImageCG.cpp',
                 'src/WebImageDecoder.cpp',
                 'src/WebImageLayer.cpp',
                 'src/WebImageSkia.cpp',
@@ -630,7 +615,13 @@
                 'src/WebScopedMicrotaskSuppression.cpp',
                 'src/WebScopedUserGesture.cpp',
                 'src/WebScriptController.cpp',
+                'src/WebScrollbarLayer.cpp',
                 'src/WebScrollableLayer.cpp',
+                'src/WebScrollbarImpl.cpp',
+                'src/WebScrollbarImpl.h',
+                'src/WebScrollbarThemeClientImpl.cpp',
+                'src/WebScrollbarThemeClientImpl.h',
+                'src/WebScrollbarThemePainter.cpp',
                 'src/WebSearchableFormData.cpp',
                 'src/WebSecurityOrigin.cpp',
                 'src/WebSecurityPolicy.cpp',
@@ -821,18 +812,13 @@
                         ['exclude', '/android/'],
                     ],
                 }],
-                # TODO: we exclude CG.cpp on both sides of the below conditional. Move elsewhere?
                 ['OS=="mac"', {
                     'include_dirs': [
                         'public/mac',
                     ],
-                    'sources/': [
-                        ['exclude', 'CG\\.cpp$'],
-                    ],
                 }, { # else: OS!="mac"
                     'sources/': [
                         ['exclude', '/mac/'],
-                        ['exclude', 'CG\\.cpp$'],
                     ],
                 }],
                 ['OS=="win"', {
@@ -984,6 +970,7 @@
                     '<(PRODUCT_DIR)/resources/inspector/ScriptFormatterWorker.js',
                     '<(PRODUCT_DIR)/resources/inspector/devTools.css',
                     '<(PRODUCT_DIR)/resources/inspector/devtools_extension_api.js',
+                    '<@(webinspector_standalone_js_files)',
                     '<@(webinspector_standalone_css_files)',
                 ],
                 'images': [
@@ -1099,6 +1086,12 @@
                         'outputs': ['<(PRODUCT_DIR)/resources/inspector/DevTools.js'],
                         'action': ['python', '<@(_script_name)', '<@(_input_page)', '<@(_search_path)', '<@(_outputs)'],
                     }],
+                    'copies': [{
+                        'destination': '<(PRODUCT_DIR)/resources/inspector',
+                        'files': [
+                            '<@(webinspector_standalone_js_files)',
+                        ],
+                    }],
                 },
                 {
                     'target_name': 'concatenated_heap_snapshot_worker_js',
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index b507189db..9d041a18d 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -77,15 +77,17 @@
             'tests/CCOcclusionTrackerTest.cpp',
             'tests/CCOcclusionTrackerTestCommon.h',
             'tests/CCQuadCullerTest.cpp',
+            'tests/CCRenderSurfaceFiltersTest.cpp',
             'tests/CCRenderSurfaceTest.cpp',
             'tests/CCResourceProviderTest.cpp',
             'tests/CCSchedulerStateMachineTest.cpp',
             'tests/CCSchedulerTestCommon.h',
             'tests/CCSchedulerTest.cpp',
             'tests/CCScopedTextureTest.cpp',
+            'tests/CCScrollbarAnimationControllerLinearFadeTest.cpp',
             'tests/CCSolidColorLayerImplTest.cpp',
             'tests/CCTestCommon.h',
-            'tests/CCTextureUpdaterTest.cpp',
+            'tests/CCTextureUpdateControllerTest.cpp',
             'tests/CCTiledLayerImplTest.cpp',
             'tests/CCTiledLayerTestCommon.h',
             'tests/CCTiledLayerTestCommon.cpp',
@@ -102,7 +104,9 @@
             'tests/EventListenerTest.cpp',
             'tests/FakeCCLayerTreeHostClient.h',
             'tests/FakeGraphicsContext3DTest.cpp',
+            'tests/FakeWebCompositorOutputSurface.h',
             'tests/FakeWebGraphicsContext3D.h',
+            'tests/FakeWebScrollbarThemeGeometry.h',
             'tests/FilterOperationsTest.cpp',
             'tests/FloatQuadTest.cpp',
             'tests/FrameLoaderClientImplTest.cpp',
@@ -115,6 +119,7 @@
             'tests/IDBFakeBackingStore.h',
             'tests/IDBKeyPathTest.cpp',
             'tests/IDBLevelDBCodingTest.cpp',
+            'tests/IDBRequestTest.cpp',
             'tests/ImageLayerChromiumTest.cpp',
             'tests/KeyboardTest.cpp',
             'tests/KURLTest.cpp',
@@ -123,9 +128,8 @@
             'tests/LevelDBTest.cpp',
             'tests/LinkHighlightTest.cpp',
             'tests/ListenerLeakTest.cpp',
-            'tests/LocalizedDateICUTest.cpp',
-            'tests/LocalizedNumberICUTest.cpp',
             'tests/MemoryInfo.cpp',
+            'tests/MemoryInstrumentationTest.cpp',
             'tests/MockCCQuadCuller.h',
             'tests/OpaqueRectTrackingContentLayerDelegateTest.cpp',
             'tests/OpenTypeVerticalDataTest.cpp',
@@ -192,6 +196,12 @@
                     'tests/ScrollAnimatorNoneTest.cpp',
                 ],
             }],
+            ['os_posix==1 and OS!="mac"', {
+                'webkit_unittest_files': [
+                    'tests/LocalizedDateICUTest.cpp',
+                    'tests/LocalizedNumberICUTest.cpp',
+                ],
+            }],
             ['toolkit_uses_gtk == 1', {
                 'webkit_unittest_files': [
                     'tests/WebInputEventFactoryTestGtk.cpp',
diff --git a/Source/WebKit/chromium/WebKitUnitTests.gyp b/Source/WebKit/chromium/WebKitUnitTests.gyp
index 81be90a0d..b05a55271 100644
--- a/Source/WebKit/chromium/WebKitUnitTests.gyp
+++ b/Source/WebKit/chromium/WebKitUnitTests.gyp
@@ -172,8 +172,18 @@
                         '--output',
                         '<(PRODUCT_DIR)/webkit_unit_tests_apk',
                         '--ant-args',
+                        '-DANDROID_SDK=<(android_sdk)',
+                        '--ant-args',
+                        '-DANDROID_SDK_ROOT=<(android_sdk_root)',
+                        '--ant-args',
+                        '-DANDROID_SDK_TOOLS=<(android_sdk_tools)',
+                        '--ant-args',
+                        '-DANDROID_SDK_VERSION=<(android_sdk_version)',
+                        '--ant-args',
+                        '-DANDROID_TOOLCHAIN=<(android_toolchain)',
+                        '--ant-args',
                         '-DPRODUCT_DIR=<(ant_build_out)',
-                        '--ant-compile',
+                        '--sdk-build=<(sdk_build)',
                         '--app_abi',
                         '<(android_app_abi)',
                     ],
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index 6aa57be3d..8dc7e2f6f 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -40,9 +40,10 @@
       'ENABLE_CSP_NEXT=1',
       'ENABLE_CSS3_FLEXBOX=1',
       'ENABLE_CSS_BOX_DECORATION_BREAK=1',
+      'ENABLE_CSS_COMPOSITING=0',
       'ENABLE_CSS_EXCLUSIONS=1',
       'ENABLE_CSS_FILTERS=1',
-      'ENABLE_CSS_COMPOSITING=0',
+      'ENABLE_CSS_HIERARCHIES=0',
       'ENABLE_CSS_IMAGE_SET=1',
       'ENABLE_CSS_IMAGE_RESOLUTION=0',
       'ENABLE_CSS_REGIONS=1',
@@ -114,6 +115,7 @@
       'ENABLE_WEB_INTENTS=1',
       'ENABLE_WEB_SOCKETS=1',
       'ENABLE_WEB_TIMING=1',
+      'ENABLE_WIDGET_REGION=1',
       'ENABLE_WORKERS=1',
       'ENABLE_XHR_RESPONSE_BLOB=1',
       'ENABLE_XSLT=1',
@@ -170,6 +172,7 @@
           'ENABLE_CALENDAR_PICKER=1',
           'ENABLE_INPUT_SPEECH=1',
           'ENABLE_INPUT_TYPE_COLOR=1',
+          'ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS=1',
           'ENABLE_JAVASCRIPT_I18N_API=1',
           'ENABLE_LEGACY_NOTIFICATIONS=1',
           'ENABLE_MEDIA_CAPTURE=0',
diff --git a/Source/WebKit/chromium/public/WebCompositor.h b/Source/WebKit/chromium/public/WebCompositor.h
deleted file mode 100644
index 6e0da2b22..000000000
--- a/Source/WebKit/chromium/public/WebCompositor.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebCompositor_h
-#define WebCompositor_h
-
-#define WEBCOMPOSITOR_OWNS_SETTINGS 1
-
-#include "platform/WebCommon.h"
-
-namespace WebKit {
-
-class WebInputEvent;
-class WebThread;
-
-// This class contains global routines for interacting with the
-// compositor.
-//
-// All calls to the WebCompositor must be made from the main thread.
-class WebCompositor {
-public:
-    // Initializes the compositor. Threaded compositing is enabled by passing in
-    // a non-null WebThread. No compositor classes or methods should be used
-    // prior to calling initialize.
-    WEBKIT_EXPORT static void initialize(WebThread*);
-
-    // Shuts down the compositor. This must be called when all compositor data
-    // types have been deleted. No compositor classes or methods should be used
-    // after shutdown.
-    WEBKIT_EXPORT static void shutdown();
-
-    // These may only be called before initialize.
-    WEBKIT_EXPORT static void setPerTilePaintingEnabled(bool);
-    WEBKIT_EXPORT static void setPartialSwapEnabled(bool);
-    WEBKIT_EXPORT static void setAcceleratedAnimationEnabled(bool);
-
-protected:
-    virtual ~WebCompositor() { }
-};
-
-} // namespace WebKit
-
-#endif
diff --git a/Source/WebKit/chromium/public/WebDocument.h b/Source/WebKit/chromium/public/WebDocument.h
index f2296b7ee..e0c444250 100644
--- a/Source/WebKit/chromium/public/WebDocument.h
+++ b/Source/WebKit/chromium/public/WebDocument.h
@@ -31,6 +31,7 @@
 #ifndef WebDocument_h
 #define WebDocument_h
 
+#include "WebDraggableRegion.h"
 #include "WebNode.h"
 #include "WebSecurityOrigin.h"
 #include "platform/WebReferrerPolicy.h"
@@ -104,6 +105,7 @@ public:
     WEBKIT_EXPORT WebElement fullScreenElement() const;
     WEBKIT_EXPORT WebDOMEvent createEvent(const WebString& eventType);
     WEBKIT_EXPORT WebReferrerPolicy referrerPolicy() const;
+    WEBKIT_EXPORT WebElement createElement(const WebString& tagName);
 
     // Accessibility support. These methods should only be called on the
     // top-level document, because one accessibility cache spans all of
@@ -120,6 +122,8 @@ public:
     // WebView.
     WEBKIT_EXPORT void insertUserStyleSheet(const WebString& sourceCode, UserStyleLevel);
 
+    WEBKIT_EXPORT WebVector<WebDraggableRegion> draggableRegions() const;
+
 #if WEBKIT_IMPLEMENTATION
     WebDocument(const WTF::PassRefPtr<WebCore::Document>&);
     WebDocument& operator=(const WTF::PassRefPtr<WebCore::Document>&);
diff --git a/Source/WebKit/chromium/public/WebDraggableRegion.h b/Source/WebKit/chromium/public/WebDraggableRegion.h
new file mode 100644
index 000000000..0437f8973
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebDraggableRegion.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebDraggableRegion_h
+#define WebDraggableRegion_h
+
+#include "platform/WebCommon.h"
+#include "platform/WebRect.h"
+#include "platform/WebString.h"
+
+namespace WebKit {
+
+struct WebDraggableRegion {
+    WebString label;
+    WebRect bounds;
+    WebRect clip;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index b03fb7c69..c0b8e2aa7 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -75,6 +75,8 @@ class WebURLRequest;
 class WebView;
 struct WebConsoleMessage;
 struct WebFindOptions;
+struct WebFloatPoint;
+struct WebFloatRect;
 struct WebPoint;
 struct WebPrintParams;
 struct WebRect;
@@ -133,6 +135,16 @@ public:
     // The name of this frame.
     virtual WebString name() const = 0;
 
+    // The unique name of this frame.
+    //
+    // This is temporarily identical to the above name() function. Once this
+    // change makes it over to the Chromium tree, I will change all callers to
+    // use this function and will subsequently move assignedName() to name().
+    virtual WebString uniqueName() const = 0;
+
+    // The name of this frame. If no name is given, empty string is returned.
+    virtual WebString assignedName() const = 0;
+
     // Sets the name of this frame. For child frames (frames that are not a
     // top-most frame) the actual name may have a suffix appended to make the
     // frame name unique within the hierarchy.
@@ -575,6 +587,30 @@ public:
     // of matches found during the scoping effort.
     virtual void resetMatchCount() = 0;
 
+    // Returns a counter that is incremented when the find-in-page markers are
+    // changed on any frame. Switching the active marker doesn't change the
+    // current version. Should be called only on the main frame.
+    virtual int findMatchMarkersVersion() const = 0;
+
+    // Returns the bounding box of the active find-in-page match marker or an
+    // empty rect if no such marker exists. The rect is returned in find-in-page
+    // coordinates whatever frame the active marker is.
+    // Should be called only on the main frame.
+    virtual WebFloatRect activeFindMatchRect() = 0;
+
+    // Swaps the contents of the provided vector with the bounding boxes of the
+    // find-in-page match markers from all frames. The bounding boxes are returned
+    // in find-in-page coordinates. This method should be called only on the main frame.
+    virtual void findMatchRects(WebVector<WebFloatRect>&) = 0;
+
+    // Selects the find-in-page match in the appropriate frame closest to the
+    // provided point in find-in-page coordinates. Returns the ordinal of such
+    // match or -1 if none could be found. If not null, selectionRect is set to
+    // the bounding box of the selected match in window coordinates.
+    // This method should be called only on the main frame.
+    virtual int selectNearestFindMatch(const WebFloatPoint&,
+                                       WebRect* selectionRect) = 0;
+
     // OrientationChange event ---------------------------------------------
 
     // Orientation is the interface orientation in degrees.
@@ -630,12 +666,6 @@ public:
     // Calls markerTextForListItem() defined in WebCore/rendering/RenderTreeAsText.h.
     virtual WebString markerTextForListItem(const WebElement&) const = 0;
 
-    // Returns the number of page where the specified element will be put.
-    // This method is used to support layout tests.
-    virtual int pageNumberForElementById(const WebString& id,
-                                         float pageWidthInPixels,
-                                         float pageHeightInPixels) const = 0;
-
     // Prints all of the pages into the canvas, with page boundaries drawn as
     // one pixel wide blue lines. This method exists to support layout tests.
     virtual void printPagesWithBoundaries(WebCanvas*, const WebSize&) = 0;
diff --git a/Source/WebKit/chromium/public/WebFrameClient.h b/Source/WebKit/chromium/public/WebFrameClient.h
index bc32d6d84..cc8923d80 100644
--- a/Source/WebKit/chromium/public/WebFrameClient.h
+++ b/Source/WebKit/chromium/public/WebFrameClient.h
@@ -93,7 +93,7 @@ public:
     // May return null.
     virtual WebApplicationCacheHost* createApplicationCacheHost(WebFrame*, WebApplicationCacheHostClient*) { return 0; }
 
-    
+
     // Services ------------------------------------------------------------
 
     // A frame specific cookie jar.  May return null, in which case
@@ -103,13 +103,15 @@ public:
 
     // General notifications -----------------------------------------------
 
-    // This frame has been detached from the view.
-    //
-    // FIXME: Do not use this in new code. Currently this is used by code in
-    // Chromium that errantly caches WebKit objects.
+    // A child frame was created in this frame. This is called when the frame
+    // is created and initialized.
+    virtual void didCreateFrame(WebFrame* parent, WebFrame* child) { }
+
+    // This frame has been detached from the view, but has not been closed yet.
     virtual void frameDetached(WebFrame*) { }
 
-    // This frame is about to be closed.
+    // This frame is about to be closed. This is called after frameDetached,
+    // when the document is being unloaded, due to new one committing.
     virtual void willClose(WebFrame*) { }
 
     // Load commands -------------------------------------------------------
@@ -406,6 +408,15 @@ public:
         WebSecurityOrigin target,
         WebDOMMessageEvent) { return false; }
 
+    virtual bool willCheckAndDispatchMessageEvent(
+        WebFrame* sourceFrame,
+        WebFrame* targetFrame,
+        WebSecurityOrigin target,
+        WebDOMMessageEvent event)
+    {
+        return willCheckAndDispatchMessageEvent(sourceFrame, target, event);
+    }
+
     // Asks the embedder if a specific user agent should be used for the given
     // URL. Non-empty strings indicate an override should be used. Otherwise,
     // WebKitPlatformSupport::userAgent() will be called to provide one.
diff --git a/Source/WebKit/chromium/public/WebIDBCallbacks.h b/Source/WebKit/chromium/public/WebIDBCallbacks.h
index ce100f295..655b009e0 100644
--- a/Source/WebKit/chromium/public/WebIDBCallbacks.h
+++ b/Source/WebKit/chromium/public/WebIDBCallbacks.h
@@ -51,12 +51,16 @@ public:
     virtual void onError(const WebIDBDatabaseError&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebDOMStringList&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBCursor*) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Temporary no-op method to allow callers to update before WK92278 lands.
+    virtual void onSuccess(WebIDBCursor*, const WebIDBKey& key, const WebIDBKey& primaryKey, const WebSerializedScriptValue&) { }
     virtual void onSuccess(WebIDBDatabase*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebIDBKey&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBTransaction*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&, const WebIDBKey&, const WebIDBKeyPath&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccessWithContinuation() { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Temporary no-op method to allow callers to update before WK92278 lands.
+    virtual void onSuccess(const WebIDBKey& key, const WebIDBKey& primaryKey, const WebSerializedScriptValue&) { }
     virtual void onBlocked() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onBlocked(long long oldVersion) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccessWithPrefetch(const WebVector<WebIDBKey>& keys, const WebVector<WebIDBKey>& primaryKeys, const WebVector<WebSerializedScriptValue>& values) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBCursor.h b/Source/WebKit/chromium/public/WebIDBCursor.h
index dfad19383..ac89d7955 100644
--- a/Source/WebKit/chromium/public/WebIDBCursor.h
+++ b/Source/WebKit/chromium/public/WebIDBCursor.h
@@ -40,6 +40,13 @@ class WebIDBCursor {
 public:
     virtual ~WebIDBCursor() { }
 
+    enum Direction {
+        Next = 0,
+        NextNoDuplicate = 1,
+        Prev = 2,
+        PrevNoDuplicate = 3,
+    };
+
     virtual WebIDBKey key() const
     {
         WEBKIT_ASSERT_NOT_REACHED();
@@ -56,7 +63,6 @@ public:
         return WebSerializedScriptValue();
     }
 
-    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void advance(unsigned long, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBObjectStore.h b/Source/WebKit/chromium/public/WebIDBObjectStore.h
index 3893c9595..ba59c15ee 100644
--- a/Source/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/Source/WebKit/chromium/public/WebIDBObjectStore.h
@@ -26,10 +26,12 @@
 #ifndef WebIDBObjectStore_h
 #define WebIDBObjectStore_h
 
-#include "WebExceptionCode.h"
 #include "WebDOMStringList.h"
+#include "WebExceptionCode.h"
 #include "WebIDBCallbacks.h"
+#include "WebIDBCursor.h"
 #include "WebIDBKeyPath.h"
+#include "WebIDBTransaction.h"
 #include "platform/WebCommon.h"
 #include "platform/WebString.h"
 
@@ -53,7 +55,6 @@ public:
 
     typedef WebVector<WebIDBKey> WebIndexKeys;
 
-    virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void putWithIndexKeys(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, const WebVector<WebString>& indexNames, const WebVector<WebIndexKeys>&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
@@ -62,6 +63,8 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
+    virtual void setIndexKeys(const WebIDBKey&, const WebVector<WebString>&, const WebVector<WebIndexKeys>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void setIndexesReady(const WebVector<WebString>&, const WebIDBTransaction&) { WEBKIT_ASSERT_NOT_REACHED(); };
     // Transfers ownership of the WebIDBIndex to the caller.
     virtual WebIDBIndex* index(const WebString& name, WebExceptionCode&)
     {
@@ -69,7 +72,9 @@ public:
         return 0;
     }
     virtual void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    // FIXME: Remove this version of openCursor when TaskType is plumbed through chromium.
     virtual void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
 
 protected:
diff --git a/Source/WebKit/chromium/public/WebIDBTransaction.h b/Source/WebKit/chromium/public/WebIDBTransaction.h
index 4ddcd8c56..816a32814 100644
--- a/Source/WebKit/chromium/public/WebIDBTransaction.h
+++ b/Source/WebKit/chromium/public/WebIDBTransaction.h
@@ -41,11 +41,11 @@ class WebIDBTransaction {
 public:
     virtual ~WebIDBTransaction() { }
 
-    virtual int mode() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return 0;
-    }
+    enum TaskType {
+        NormalTask = 0,
+        PreemptiveTask
+    };
+
     virtual WebIDBObjectStore* objectStore(const WebString& name, WebExceptionCode&)
     {
         WEBKIT_ASSERT_NOT_REACHED();
diff --git a/Source/WebKit/chromium/public/WebInputEvent.h b/Source/WebKit/chromium/public/WebInputEvent.h
index 40a6fdb3e..09048cded 100644
--- a/Source/WebKit/chromium/public/WebInputEvent.h
+++ b/Source/WebKit/chromium/public/WebInputEvent.h
@@ -370,7 +370,11 @@ public:
     int globalX;
     int globalY;
 
-    // NOTE: |deltaX| and |deltaY| represents the amount to scroll for Scroll gesture events. For Pinch gesture events, |deltaX| represents the scaling/magnification factor. For a GestureTap event, |deltaX| and |deltaY| represent the horizontal and vertical radii of the touch region.
+    // NOTE: |deltaX| and |deltaY| represents the amount to scroll for Scroll gesture events.
+    // For Pinch gesture events, |deltaX| represents the scaling/magnification factor.
+    // For a GestureTap event, |deltaX| represents the tap count.
+    // For a FlingStart event, |deltaX| and |deltaY| represent the velocity.
+    // FIXME: Avoid overloading 'delta' in this way. http://wkb.ug/93123
     float deltaX;
     float deltaY;
     WebRect boundingBox;
diff --git a/Source/WebKit/chromium/public/WebNode.h b/Source/WebKit/chromium/public/WebNode.h
index 5281db199..902b37669 100644
--- a/Source/WebKit/chromium/public/WebNode.h
+++ b/Source/WebKit/chromium/public/WebNode.h
@@ -98,6 +98,7 @@ public:
     WEBKIT_EXPORT WebNode nextSibling() const;
     WEBKIT_EXPORT bool hasChildNodes() const;
     WEBKIT_EXPORT WebNodeList childNodes();
+    WEBKIT_EXPORT bool appendChild(const WebNode& child);
     WEBKIT_EXPORT WebString createMarkup() const;
     WEBKIT_EXPORT bool isLink() const;
     WEBKIT_EXPORT bool isTextNode() const;
diff --git a/Source/WebKit/chromium/public/WebPlugin.h b/Source/WebKit/chromium/public/WebPlugin.h
index 5ef884c73..8abaf3bfe 100644
--- a/Source/WebKit/chromium/public/WebPlugin.h
+++ b/Source/WebKit/chromium/public/WebPlugin.h
@@ -65,6 +65,7 @@ public:
     // from the plugin. The value would be associated with the name attribute
     // of the corresponding object element.
     virtual bool getFormValue(WebString&) { return false; }
+    virtual bool supportsKeyboardFocus() const { return false; }
 
     virtual void paint(WebCanvas*, const WebRect&) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index c3d61d85a..7152249e5 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -157,6 +157,9 @@ public:
     WEBKIT_EXPORT static void enableDialogElement(bool);
     WEBKIT_EXPORT static bool isDialogElementEnabled();
 
+    WEBKIT_EXPORT static void enableCSSExclusions(bool);
+    WEBKIT_EXPORT static bool isCSSExclusionsEnabled();
+
 private:
     WebRuntimeFeatures();
 };
diff --git a/Source/WebKit/chromium/public/WebScriptController.h b/Source/WebKit/chromium/public/WebScriptController.h
index da3ac1cdd..1299ae9cb 100644
--- a/Source/WebKit/chromium/public/WebScriptController.h
+++ b/Source/WebKit/chromium/public/WebScriptController.h
@@ -39,18 +39,11 @@ class Extension;
 
 namespace WebKit {
 
-class WebString;
-
 class WebScriptController {
 public:
-    // Registers a v8 extension to be available on webpages. The three forms
-    // offer various restrictions on what types of contexts the extension is
-    // loaded into. If a scheme is provided, only pages whose URL has the given
-    // scheme will match. If extensionGroup is provided, the extension will only
-    // be loaded into scripts run via WebFrame::ExecuteInNewWorld with the
-    // matching group.
-    // Will only affect v8 contexts initialized after this call. Takes ownership
-    // of the v8::Extension object passed.
+    // Registers a v8 extension to be available on webpages. Will only affect
+    // v8 contexts initialized after this call. Takes ownership of the
+    // v8::Extension object passed.
     WEBKIT_EXPORT static void registerExtension(v8::Extension*);
 
     // Enables special settings which are only applicable if V8 is executed
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 88ed9639d..e1e74a9b9 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -53,7 +53,6 @@ public:
         EditingBehaviorUnix
     };
 
-    virtual bool forceSoftwareCompositing() const = 0;
     virtual bool scrollAnimatorEnabled() const = 0;
     virtual bool viewportEnabled() const = 0;
     virtual void setAccelerated2dCanvasEnabled(bool) = 0;
@@ -102,7 +101,6 @@ public:
     virtual void setFixedPositionCreatesStackingContext(bool) = 0;
     virtual void setFontRenderingModeNormal() = 0;
     virtual void setForceCompositingMode(bool) = 0;
-    virtual void setForceSoftwareCompositing(bool) = 0;
     virtual void setFrameFlatteningEnabled(bool) = 0;
     virtual void setFullScreenEnabled(bool) = 0;
     virtual void setHyperlinkAuditingEnabled(bool) = 0;
@@ -132,6 +130,7 @@ public:
     virtual void setPictographFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setPluginsEnabled(bool) = 0;
     virtual void setPrivilegedWebGLExtensionsEnabled(bool) = 0;
+    virtual void setRenderVSyncEnabled(bool) = 0;
     virtual void setSansSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON) = 0;
     virtual void setShouldPrintBackgrounds(bool) = 0;
@@ -144,6 +143,7 @@ public:
     virtual void setSyncXHRInDocumentsEnabled(bool) = 0;
     virtual void setTextAreasAreResizable(bool) = 0;
     virtual void setTextAutosizingEnabled(bool) = 0;
+    virtual void setTextAutosizingFontScaleFactor(float) = 0;
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded() = 0;
     virtual void setUnifiedTextCheckerEnabled(bool) = 0;
     virtual void setUserStyleSheetLocation(const WebURL&) = 0;
diff --git a/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h b/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h
index 608bfb481..3fe1244a7 100644
--- a/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h
+++ b/Source/WebKit/chromium/public/WebSpeechRecognizerClient.h
@@ -59,13 +59,6 @@ public:
     // This is expected to be called after didStartAudio.
     virtual void didStartSound(const WebSpeechRecognitionHandle&) = 0;
 
-    // To be called when speech has been detected.
-    // This is expected to be called after didStartSound.
-    virtual void didStartSpeech(const WebSpeechRecognitionHandle&) = 0;
-
-    // To be called when speech is no longer detected.
-    virtual void didEndSpeech(const WebSpeechRecognitionHandle&) = 0;
-
     // To be called when sound is no longer detected.
     // This is expected to be called after didEndSpeech.
     virtual void didEndSound(const WebSpeechRecognitionHandle&) = 0;
diff --git a/Source/WebKit/chromium/public/WebCompositorClient.h b/Source/WebKit/chromium/public/WebTouchCandidatesInfo.h
index c275f7055..65d4024a2 100644
--- a/Source/WebKit/chromium/public/WebCompositorClient.h
+++ b/Source/WebKit/chromium/public/WebTouchCandidatesInfo.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,19 +23,30 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositorClient_h
-#define WebCompositorClient_h
+#ifndef WebTouchCandidatesInfo_h
+#define WebTouchCandidatesInfo_h
 
-#include "WebCompositorInputHandlerClient.h"
+#include "platform/WebRect.h"
 
 namespace WebKit {
 
-// This class will go away once downstream code has transitioned
-// to WebCompositorInputHandlerClient.
-class WebCompositorClient : public WebCompositorInputHandlerClient {
-public:
-protected:
-    virtual ~WebCompositorClient() { }
+struct WebTouchCandidatesInfo {
+    // The number of possible touch receivers from the last touch.
+    int numberOfCandidates;
+
+    // The bounds of the possible touch candidates. This will enclose the
+    // rects of any possible touch candidates for a press.
+    WebRect unitedBounds;
+
+    // The smallest dimension (either width or height) of any of the
+    // available touch targets.
+    int smallestDimension;
+
+    WebTouchCandidatesInfo()
+        : numberOfCandidates(0)
+        , smallestDimension(0)
+    {
+    }
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/public/WebView.h b/Source/WebKit/chromium/public/WebView.h
index 4da3363dd..e8f791fa6 100644
--- a/Source/WebKit/chromium/public/WebView.h
+++ b/Source/WebKit/chromium/public/WebView.h
@@ -60,9 +60,11 @@ class WebString;
 class WebTextFieldDecoratorClient;
 class WebViewClient;
 struct WebActiveWheelFlingParameters;
+struct WebFloatQuad;
 struct WebMediaPlayerAction;
 struct WebPluginAction;
 struct WebPoint;
+struct WebTouchCandidatesInfo;
 
 class WebView : public WebWidget {
 public:
@@ -461,10 +463,24 @@ public:
 
     virtual bool isSelectionEditable() const = 0;
 
-    // Benchmarking support --------------------------------------------
+    // Benchmarking support -------------------------------------------------
 
     virtual WebViewBenchmarkSupport* benchmarkSupport() { return 0; }
 
+
+    // Touch ----------------------------------------------------------------
+
+    // Returns a list of layout bounding boxes of the event target node touched by
+    // the input point with the padding. If no target node is found, an empty
+    // list is returned. If the node is of an inline type, each line box is returned
+    // separately. Otherwise, one bounding box is returned. Also returns information
+    // about the found candidates and their dimension, and the highlight color to use.
+    virtual WebVector<WebFloatQuad> getTouchHighlightQuads(const WebPoint&,
+                                                           int padding,
+                                                           WebTouchCandidatesInfo& outTouchInfo,
+                                                           WebColor& outTapHighlightColor) = 0;
+
+
     // Visibility -----------------------------------------------------------
 
     // Sets the visibility of the WebView.
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index 65964a128..726cc6482 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -53,6 +53,7 @@ class WebAccessibilityObject;
 class WebBatteryStatusClient;
 class WebColorChooser;
 class WebColorChooserClient;
+class WebCompositorOutputSurface;
 class WebDeviceOrientationClient;
 class WebDragData;
 class WebElement;
@@ -118,9 +119,11 @@ public:
     // Create a session storage namespace object associated with this WebView.
     virtual WebStorageNamespace* createSessionStorageNamespace(unsigned quota) { return 0; }
 
-    // Creates a graphics context that renders to the client's WebView.
+    // DEPRECATED: Creates a graphics context that renders to the client's WebView.
     virtual WebGraphicsContext3D* createGraphicsContext3D(const WebGraphicsContext3D::Attributes&) { return 0; }
 
+    // Creates the output surface that renders to the client's WebView.
+    virtual WebCompositorOutputSurface* createOutputSurface() { return 0; }
 
     // Misc ----------------------------------------------------------------
 
@@ -373,7 +376,18 @@ public:
     // around a hit test result. The embedder should use platform-specific
     // content detectors (e.g., from the Android intent system) to analyze the
     // region around the hit test result.
-    virtual WebContentDetectionResult detectContentAround(const WebHitTestResult&) { return WebContentDetectionResult(); }
+    virtual WebContentDetectionResult detectContentIntentAround(const WebHitTestResult&) { return WebContentDetectionResult(); }
+
+    // Schedules a new content intent with the provided url.
+    virtual void scheduleContentIntent(const WebURL&) { }
+
+    // Cancels any previously scheduled content intents that have not yet launched.
+    virtual void cancelScheduledContentIntents() { }
+
+    // Draggable regions ----------------------------------------------------
+
+    // Informs the browser that the draggable regions have been updated.
+    virtual void draggableRegionsChanged() { }
 
 protected:
     ~WebViewClient() { }
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index b2a57d66e..8e4fecac7 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -222,8 +222,9 @@ public:
     // following the call to instrumentBeginFrame().
     virtual void instrumentCancelFrame() { }
 
-    // Fills in a WebRenderingStats struct containing information about the state of the compositor.
-    // This call is relatively expensive in threaded mode as it blocks on the compositor thread.
+    // Fills in a WebRenderingStats struct containing information about rendering, e.g. count of frames rendered, time spent painting.
+    // This call is relatively expensive in threaded compositing mode, as it blocks on the compositor thread.
+    // It is safe to call in software mode, but will only give stats for rendering done in compositing mode.
     virtual void renderingStats(WebRenderingStats&) const { }
 
     // The page background color. Can be used for filling in areas without
diff --git a/Source/WebKit/chromium/public/platform/WebContentLayer.h b/Source/WebKit/chromium/public/platform/WebContentLayer.h
deleted file mode 100644
index 90a16ed91..000000000
--- a/Source/WebKit/chromium/public/platform/WebContentLayer.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebContentLayer.h"
diff --git a/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h b/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h
deleted file mode 100644
index 000826df7..000000000
--- a/Source/WebKit/chromium/public/platform/WebExternalTextureLayer.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebExternalTextureLayer.h"
diff --git a/Source/WebKit/chromium/public/platform/WebLayer.h b/Source/WebKit/chromium/public/platform/WebLayer.h
deleted file mode 100644
index 234c2fc4b..000000000
--- a/Source/WebKit/chromium/public/platform/WebLayer.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebLayer.h"
diff --git a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h b/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
deleted file mode 100644
index 2ea2915e1..000000000
--- a/Source/WebKit/chromium/public/platform/WebLayerTreeView.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebLayerTreeView.h"
diff --git a/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h b/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h
deleted file mode 100644
index 36c61f584..000000000
--- a/Source/WebKit/chromium/public/platform/WebLayerTreeViewClient.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebLayerTreeViewClient.h"
diff --git a/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h b/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h
deleted file mode 100644
index f4edbd489..000000000
--- a/Source/WebKit/chromium/public/platform/WebSolidColorLayer.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "../../../../Platform/chromium/public/WebSolidColorLayer.h"
diff --git a/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h b/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h
index b9dee63a4..54b5f1c7d 100644
--- a/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h
+++ b/Source/WebKit/chromium/src/ApplicationCacheHostInternal.h
@@ -35,9 +35,7 @@
 #include "WebApplicationCacheHostClient.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebURL.h"
+#include <public/WebURL.h>
 
 namespace WebCore {
 
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 5f250351a..8f2dc5e86 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -49,11 +49,13 @@
 #include "GeolocationError.h"
 #include "GeolocationPosition.h"
 #include "HTMLInputElement.h"
+#include "IDBCursor.h"
 #include "IDBDatabaseException.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBKeyPath.h"
 #include "IDBMetadata.h"
+#include "IDBTransactionBackendInterface.h"
 #include "IceOptions.h"
 #include "IconURL.h"
 #include "MediaPlayer.h"
@@ -84,11 +86,13 @@
 #include "WebFontDescription.h"
 #include "WebGeolocationError.h"
 #include "WebGeolocationPosition.h"
+#include "WebIDBCursor.h"
 #include "WebIDBDatabaseException.h"
 #include "WebIDBFactory.h"
 #include "WebIDBKey.h"
 #include "WebIDBKeyPath.h"
 #include "WebIDBMetadata.h"
+#include "WebIDBTransaction.h"
 #include "WebIconURL.h"
 #include "WebInputElement.h"
 #include "WebMediaPlayer.h"
@@ -433,6 +437,23 @@ COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollByPage, ScrollByPage);
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollByDocument, ScrollByDocument);
 COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollByPixel, ScrollByPixel);
 
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::RegularScrollbar, RegularScrollbar);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::SmallScrollbar, SmallScrollbar);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::NoPart, NoPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::BackButtonStartPart, BackButtonStartPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ForwardButtonStartPart, ForwardButtonStartPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::BackTrackPart, BackTrackPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ThumbPart, ThumbPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ForwardTrackPart, ForwardTrackPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::BackButtonEndPart, BackButtonEndPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ForwardButtonEndPart, ForwardButtonEndPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarBGPart, ScrollbarBGPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::TrackBGPart, TrackBGPart);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::AllParts, AllParts);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleDefault, ScrollbarOverlayStyleDefault);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleDark, ScrollbarOverlayStyleDark);
+COMPILE_ASSERT_MATCHING_ENUM(WebScrollbar::ScrollbarOverlayStyleLight, ScrollbarOverlayStyleLight);
+
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorMac, EditingMacBehavior);
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorWin, EditingWindowsBehavior);
 COMPILE_ASSERT_MATCHING_ENUM(WebSettings::EditingBehaviorUnix, EditingUnixBehavior);
@@ -465,6 +486,14 @@ COMPILE_ASSERT_MATCHING_ENUM(WebIDBKeyPath::StringType, IDBKeyPath::StringType);
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBKeyPath::ArrayType, IDBKeyPath::ArrayType);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebIDBMetadata::NoIntVersion, IDBDatabaseMetadata::NoIntVersion);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::Next, IDBCursor::NEXT);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::NextNoDuplicate, IDBCursor::NEXT_NO_DUPLICATE);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::Prev, IDBCursor::PREV);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBCursor::PrevNoDuplicate, IDBCursor::PREV_NO_DUPLICATE);
+
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBTransaction::PreemptiveTask, IDBTransactionBackendInterface::PreemptiveTask);
+COMPILE_ASSERT_MATCHING_ENUM(WebIDBTransaction::NormalTask, IDBTransactionBackendInterface::NormalTask);
 #endif
 
 #if ENABLE(FILE_SYSTEM)
diff --git a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
index 086e79e7d..b2ceab78b 100644
--- a/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
+++ b/Source/WebKit/chromium/src/AssociatedURLLoader.cpp
@@ -40,16 +40,14 @@
 #include "WebApplicationCacheHost.h"
 #include "WebDataSource.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
 #include "WrappedResourceRequest.h"
 #include "WrappedResourceResponse.h"
 #include "XMLHttpRequest.h"
-#include "platform/WebHTTPHeaderVisitor.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebString.h"
-#include "platform/WebURLError.h"
-#include "platform/WebURLLoaderClient.h"
-#include "platform/WebURLRequest.h"
+#include <public/WebHTTPHeaderVisitor.h>
+#include <public/WebString.h>
+#include <public/WebURLError.h>
+#include <public/WebURLLoaderClient.h>
+#include <public/WebURLRequest.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/WTFString.h>
 
diff --git a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
index 5f608a3d9..a6b9b64f9 100644
--- a/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/AsyncFileSystemChromium.cpp
@@ -41,9 +41,6 @@
 #include "WebFileInfo.h"
 #include "WebFileSystemCallbacksImpl.h"
 #include "WebFileWriter.h"
-#include "WebKit.h"
-#include "platform/WebFileSystem.h"
-#include "platform/WebKitPlatformSupport.h"
 #include <public/Platform.h>
 #include <public/WebFileSystem.h>
 #include <wtf/text/CString.h>
@@ -102,7 +99,7 @@ PassOwnPtr<AsyncFileSystem> AsyncFileSystem::create()
 }
 
 AsyncFileSystemChromium::AsyncFileSystemChromium()
-    : m_webFileSystem(WebKit::webKitPlatformSupport()->fileSystem())
+    : m_webFileSystem(WebKit::Platform::current()->fileSystem())
 {
     ASSERT(m_webFileSystem);
 }
diff --git a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
index cadb2e3a9..646e9ef0d 100644
--- a/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
+++ b/Source/WebKit/chromium/src/AudioDestinationChromium.cpp
@@ -52,13 +52,14 @@ const size_t fifoSize = 8192;
 const unsigned numberOfChannels = 2;
 
 // Factory method: Chromium-implementation
-PassOwnPtr<AudioDestination> AudioDestination::create(AudioSourceProvider& provider, float sampleRate)
+PassOwnPtr<AudioDestination> AudioDestination::create(AudioIOCallback& callback, float sampleRate)
 {
-    return adoptPtr(new AudioDestinationChromium(provider, sampleRate));
+    return adoptPtr(new AudioDestinationChromium(callback, sampleRate));
 }
 
-AudioDestinationChromium::AudioDestinationChromium(AudioSourceProvider& provider, float sampleRate)
-    : m_renderBus(numberOfChannels, renderBufferSize, false)
+AudioDestinationChromium::AudioDestinationChromium(AudioIOCallback& callback, float sampleRate)
+    : m_callback(callback)
+    , m_renderBus(numberOfChannels, renderBufferSize, false)
     , m_sampleRate(sampleRate)
     , m_isPlaying(false)
 {
@@ -78,7 +79,7 @@ AudioDestinationChromium::AudioDestinationChromium(AudioSourceProvider& provider
     // contains enough data, the data will be provided directly.
     // Otherwise, the FIFO will call the provider enough times to
     // satisfy the request for data.
-    m_fifo = adoptPtr(new AudioPullFIFO(provider, numberOfChannels, fifoSize, renderBufferSize));
+    m_fifo = adoptPtr(new AudioPullFIFO(*this, numberOfChannels, fifoSize, renderBufferSize));
 }
 
 AudioDestinationChromium::~AudioDestinationChromium()
@@ -127,6 +128,12 @@ void AudioDestinationChromium::render(const WebVector<float*>& audioData, size_t
     m_fifo->consume(&m_renderBus, numberOfFrames);
 }
 
+void AudioDestinationChromium::provideInput(AudioBus* bus, size_t framesToProcess)
+{
+    // FIXME: Add support for local/live audio input.
+    m_callback.render(0, bus, framesToProcess);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebKit/chromium/src/AudioDestinationChromium.h b/Source/WebKit/chromium/src/AudioDestinationChromium.h
index be4cc4b84..fd676d102 100644
--- a/Source/WebKit/chromium/src/AudioDestinationChromium.h
+++ b/Source/WebKit/chromium/src/AudioDestinationChromium.h
@@ -31,6 +31,7 @@
 
 #include "AudioBus.h"
 #include "AudioDestination.h"
+#include "AudioIOCallback.h"
 #include "AudioSourceProvider.h"
 #include "platform/WebAudioDevice.h"
 #include "platform/WebVector.h"
@@ -43,9 +44,9 @@ class AudioPullFIFO;
 
 // An AudioDestination using Chromium's audio system
 
-class AudioDestinationChromium : public AudioDestination, public WebKit::WebAudioDevice::RenderCallback {
+class AudioDestinationChromium : public AudioDestination, public WebKit::WebAudioDevice::RenderCallback, public AudioSourceProvider {
 public:
-    AudioDestinationChromium(AudioSourceProvider&, float sampleRate);
+    AudioDestinationChromium(AudioIOCallback&, float sampleRate);
     virtual ~AudioDestinationChromium();
 
     virtual void start();
@@ -57,7 +58,11 @@ public:
     // WebKit::WebAudioDevice::RenderCallback
     virtual void render(const WebKit::WebVector<float*>& audioData, size_t numberOfFrames);
 
+    // WebCore::AudioSourceProvider
+    virtual void provideInput(AudioBus*, size_t framesToProcess);
+
 private:
+    AudioIOCallback& m_callback;
     AudioBus m_renderBus;
     float m_sampleRate;
     bool m_isPlaying;
diff --git a/Source/WebKit/chromium/src/BlobRegistryProxy.cpp b/Source/WebKit/chromium/src/BlobRegistryProxy.cpp
index 05fbb3638..a78bde36e 100644
--- a/Source/WebKit/chromium/src/BlobRegistryProxy.cpp
+++ b/Source/WebKit/chromium/src/BlobRegistryProxy.cpp
@@ -37,11 +37,10 @@
 #include "BlobData.h"
 #include "KURL.h"
 #include "ResourceHandle.h"
-#include "WebKit.h"
-#include "platform/WebURL.h"
 #include <public/Platform.h>
 #include <public/WebBlobData.h>
 #include <public/WebBlobRegistry.h>
+#include <public/WebURL.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 
diff --git a/Source/WebKit/chromium/src/CCThreadImpl.cpp b/Source/WebKit/chromium/src/CCThreadImpl.cpp
deleted file mode 100644
index ef7bb5cb3..000000000
--- a/Source/WebKit/chromium/src/CCThreadImpl.cpp
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "CCThreadImpl.h"
-
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebThread.h"
-#include "cc/CCCompletionEvent.h"
-#include <stdint.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-// Task that, when runs, places the current thread ID into the provided
-// pointer and signals a completion event.
-//
-// Does not provide a PassOwnPtr<GetThreadIDTask>::create method because
-// the resulting object is always handed into a WebThread, which does not understand
-// PassOwnPtrs.
-class GetThreadIDTask : public WebThread::Task {
-public:
-    GetThreadIDTask(ThreadIdentifier* result, CCCompletionEvent* completion)
-         : m_completion(completion)
-         , m_result(result) { }
-
-    virtual ~GetThreadIDTask() { }
-
-    virtual void run()
-    {
-        *m_result = currentThread();
-        m_completion->signal();
-    }
-
-private:
-    CCCompletionEvent* m_completion;
-    ThreadIdentifier* m_result;
-};
-
-// General adapter from a CCThread::Task to a WebThread::Task.
-class CCThreadTaskAdapter : public WebThread::Task {
-public:
-    CCThreadTaskAdapter(PassOwnPtr<CCThread::Task> task) : m_task(task) { }
-
-    virtual ~CCThreadTaskAdapter() { }
-
-    virtual void run()
-    {
-        m_task->performTask();
-    }
-
-private:
-    OwnPtr<CCThread::Task> m_task;
-};
-
-PassOwnPtr<CCThread> CCThreadImpl::create(WebThread* thread)
-{
-    return adoptPtr(new CCThreadImpl(thread));
-}
-
-CCThreadImpl::~CCThreadImpl()
-{
-}
-
-void CCThreadImpl::postTask(PassOwnPtr<CCThread::Task> task)
-{
-    m_thread->postTask(new CCThreadTaskAdapter(task));
-}
-
-void CCThreadImpl::postDelayedTask(PassOwnPtr<CCThread::Task> task, long long delayMs)
-{
-    m_thread->postDelayedTask(new CCThreadTaskAdapter(task), delayMs);
-}
-
-ThreadIdentifier CCThreadImpl::threadID() const
-{
-    return m_threadID;
-}
-
-CCThreadImpl::CCThreadImpl(WebThread* thread)
-    : m_thread(thread)
-{
-    if (thread == WebKit::Platform::current()->currentThread()) {
-        m_threadID = currentThread();
-        return;
-    }
-
-    // Get the threadId for the newly-created thread by running a task
-    // on that thread, blocking on the result.
-    m_threadID = currentThread();
-    CCCompletionEvent completion;
-    m_thread->postTask(new GetThreadIDTask(&m_threadID, &completion));
-    completion.wait();
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index f7cb94bbc..ad1000e63 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -37,7 +37,7 @@
 #if ENABLE(INPUT_TYPE_COLOR)
 #include "ColorChooser.h"
 #include "ColorChooserClient.h"
-#include "ColorChooserProxy.h"
+#include "ColorChooserUIController.h"
 #endif
 #include "Console.h"
 #include "Cursor.h"
@@ -77,7 +77,6 @@
 #include "WebAccessibilityObject.h"
 #if ENABLE(INPUT_TYPE_COLOR)
 #include "WebColorChooser.h"
-#include "WebColorChooserClientImpl.h"
 #endif
 #include "WebConsoleMessage.h"
 #include "WebCursorInfo.h"
@@ -694,17 +693,16 @@ void ChromeClientImpl::reachedApplicationCacheOriginQuota(SecurityOrigin*, int64
 }
 
 #if ENABLE(INPUT_TYPE_COLOR)
-PassOwnPtr<ColorChooser> ChromeClientImpl::createColorChooser(ColorChooserClient* chooserClient, const Color& initialColor)
+PassOwnPtr<ColorChooser> ChromeClientImpl::createColorChooser(ColorChooserClient* chooserClient, const Color&)
+{
+    return adoptPtr(new ColorChooserUIController(this, chooserClient));
+}
+PassOwnPtr<WebColorChooser> ChromeClientImpl::createWebColorChooser(WebColorChooserClient* chooserClient, const WebColor& initialColor)
 {
     WebViewClient* client = m_webView->client();
     if (!client)
         return nullptr;
-    WebColorChooserClientImpl* chooserClientProxy = new WebColorChooserClientImpl(chooserClient);
-    WebColor webColor = static_cast<WebColor>(initialColor.rgb());
-    WebColorChooser* chooser = client->createColorChooser(chooserClientProxy, webColor);
-    if (!chooser)
-        return nullptr;
-    return adoptPtr(new ColorChooserProxy(adoptPtr(chooser)));
+    return adoptPtr(client->createColorChooser(chooserClient, initialColor));
 }
 #endif
 
@@ -1114,6 +1112,15 @@ bool ChromeClientImpl::isPointerLocked()
 }
 #endif
 
+#if ENABLE(WIDGET_REGION)
+void ChromeClientImpl::dashboardRegionsChanged()
+{
+    WebViewClient* client = m_webView->client();
+    if (client)
+        client->draggableRegionsChanged();
+}
+#endif
+
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
 PassOwnPtr<RegisterProtocolHandlerClientImpl> RegisterProtocolHandlerClientImpl::create(WebViewImpl* webView)
 {
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.h b/Source/WebKit/chromium/src/ChromeClientImpl.h
index 30315d394..a786dc5eb 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.h
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.h
@@ -37,14 +37,13 @@
 #include "RegisterProtocolHandlerClient.h"
 #include "SearchPopupMenu.h"
 #include "WebNavigationPolicy.h"
+#include <public/WebColor.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 class AccessibilityObject;
-#if ENABLE(INPUT_TYPE_COLOR)
 class ColorChooser;
 class ColorChooserClient;
-#endif
 class Element;
 class FileChooser;
 class PopupContainer;
@@ -55,6 +54,8 @@ struct WindowFeatures;
 }
 
 namespace WebKit {
+class WebColorChooser;
+class WebColorChooserClient;
 class WebViewImpl;
 struct WebCursorInfo;
 struct WebPopupMenuInfo;
@@ -135,9 +136,13 @@ public:
         WebCore::Frame*, const WTF::String& databaseName);
     virtual void reachedMaxAppCacheSize(int64_t spaceNeeded);
     virtual void reachedApplicationCacheOriginQuota(WebCore::SecurityOrigin*, int64_t totalSpaceNeeded);
+#if ENABLE(WIDGET_REGION)
+    virtual void dashboardRegionsChanged();
+#endif
     virtual bool paintCustomOverhangArea(WebCore::GraphicsContext*, const WebCore::IntRect&, const WebCore::IntRect&, const WebCore::IntRect&);
 #if ENABLE(INPUT_TYPE_COLOR)
     virtual PassOwnPtr<WebCore::ColorChooser> createColorChooser(WebCore::ColorChooserClient*, const WebCore::Color&) OVERRIDE;
+    PassOwnPtr<WebColorChooser> createWebColorChooser(WebColorChooserClient*, const WebColor&);
 #endif
     virtual void runOpenPanel(WebCore::Frame*, PassRefPtr<WebCore::FileChooser>);
     virtual void loadIconForFiles(const Vector<WTF::String>&, WebCore::FileIconLoader*);
diff --git a/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp b/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp
index 25090fdd0..c1ab19609 100644
--- a/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp
+++ b/Source/WebKit/chromium/src/ChromiumCurrentTime.cpp
@@ -29,10 +29,9 @@
  */
 
 #include "config.h"
-#include <wtf/CurrentTime.h>
 
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
+#include <public/Platform.h>
+#include <wtf/CurrentTime.h>
 
 namespace WTF {
 
diff --git a/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp b/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp
index 9a31f4ae4..00691b49e 100644
--- a/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp
+++ b/Source/WebKit/chromium/src/ChromiumOSRandomSource.cpp
@@ -31,8 +31,6 @@
 #include "config.h"
 #include <wtf/OSRandomSource.h>
 
-#include "WebKit.h"
-
 #include <public/Platform.h>
 
 namespace WTF {
diff --git a/Source/WebKit/chromium/src/ChromiumThreading.cpp b/Source/WebKit/chromium/src/ChromiumThreading.cpp
index bc677f3c9..d6520e2b3 100644
--- a/Source/WebKit/chromium/src/ChromiumThreading.cpp
+++ b/Source/WebKit/chromium/src/ChromiumThreading.cpp
@@ -29,12 +29,9 @@
  */
 
 #include "config.h"
-#include <wtf/chromium/ChromiumThreading.h>
-
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 
-#include <wtf/MainThread.h>
+#include <public/Platform.h>
+#include <wtf/chromium/ChromiumThreading.h>
 
 namespace WTF {
 
diff --git a/Source/WebKit/chromium/src/ColorChooserUIController.cpp b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
new file mode 100644
index 000000000..28cdc3840
--- /dev/null
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ColorChooserUIController.h"
+
+#if ENABLE(INPUT_TYPE_COLOR)
+
+#include "ChromeClientImpl.h"
+#include "Color.h"
+#include "ColorChooserClient.h"
+#include "ColorSuggestionPicker.h"
+#include "IntRect.h"
+#include "LocalizedStrings.h"
+#include "WebColorChooser.h"
+#include "platform/WebColor.h"
+#include "platform/WebKitPlatformSupport.h"
+#include <public/WebLocalizedString.h>
+
+namespace WebKit {
+
+// Keep in sync with Actions in colorSuggestionPicker.js.
+enum ColorPickerPopupAction {
+    ColorPickerPopupActionChooseOtherColor = -2,
+    ColorPickerPopupActionCancel = -1,
+    ColorPickerPopupActionSetValue = 0
+};
+
+ColorChooserUIController::ColorChooserUIController(ChromeClientImpl* chromeClient, WebCore::ColorChooserClient* client)
+    : m_chromeClient(chromeClient)
+    , m_client(client)
+    , m_popup(0)
+{
+    if (m_client->shouldShowSuggestions())
+        openPopup();
+    else
+        openColorChooser();
+}
+
+ColorChooserUIController::~ColorChooserUIController()
+{
+}
+
+void ColorChooserUIController::setSelectedColor(const WebCore::Color& color)
+{
+    ASSERT(m_chooser);
+    m_chooser->setSelectedColor(static_cast<WebColor>(color.rgb()));
+}
+
+void ColorChooserUIController::endChooser()
+{
+    if (m_chooser)
+        m_chooser->endChooser();
+    if (m_popup)
+        closePopup();
+}
+
+void ColorChooserUIController::didChooseColor(const WebColor& color)
+{
+    ASSERT(m_client);
+    m_client->didChooseColor(WebCore::Color(static_cast<WebCore::RGBA32>(color)));
+}
+
+void ColorChooserUIController::didEndChooser()
+{
+    ASSERT(m_client);
+    m_chooser = nullptr;
+    m_client->didEndChooser();
+}
+
+WebCore::IntSize ColorChooserUIController::contentSize()
+{
+    return WebCore::IntSize(0, 0);
+}
+
+void ColorChooserUIController::writeDocument(WebCore::DocumentWriter& writer)
+{
+    Vector<WebCore::Color> suggestions = m_client->suggestions();
+    Vector<String> suggestionValues;
+    for (unsigned i = 0; i < suggestions.size(); i++)
+        suggestionValues.append(suggestions[i].serialized());
+    
+    WebCore::PagePopupClient::addString("<!DOCTYPE html><head><meta charset='UTF-8'><style>\n", writer);
+    writer.addData(WebCore::colorSuggestionPickerCss, sizeof(WebCore::colorSuggestionPickerCss));
+    WebCore::PagePopupClient::addString("</style></head><body><div id=main>Loading...</div><script>\n"
+                                      "window.dialogArguments = {\n", writer);
+    WebCore::PagePopupClient::addProperty("values", suggestionValues, writer);       
+    WebCore::PagePopupClient::addProperty("otherColorLabel", Platform::current()->queryLocalizedString(WebLocalizedString::OtherColorLabel), writer);
+    WebCore::PagePopupClient::addString("};\n", writer);
+    writer.addData(WebCore::colorSuggestionPickerJs, sizeof(WebCore::colorSuggestionPickerJs));
+    WebCore::PagePopupClient::addString("</script></body>\n", writer);
+}
+
+void ColorChooserUIController::setValueAndClosePopup(int numValue, const String& stringValue)
+{
+    ASSERT(m_popup);
+    ASSERT(m_client);
+    if (numValue == ColorPickerPopupActionSetValue)
+        m_client->didChooseColor(WebCore::Color(stringValue));
+    if (numValue == ColorPickerPopupActionChooseOtherColor)
+        openColorChooser();
+    closePopup();
+}
+
+void ColorChooserUIController::didClosePopup()
+{
+    m_popup = 0;
+
+    if (!m_chooser)
+        didEndChooser();
+}
+
+void ColorChooserUIController::openPopup()
+{
+    ASSERT(!m_popup);
+    m_popup = m_chromeClient->openPagePopup(this, m_client->elementRectRelativeToRootView());
+}
+
+void ColorChooserUIController::closePopup()
+{
+    if (!m_popup)
+        return;
+    m_chromeClient->closePagePopup(m_popup);
+}
+
+void ColorChooserUIController::openColorChooser()
+{
+    ASSERT(!m_chooser);
+    m_chooser = m_chromeClient->createWebColorChooser(this, static_cast<WebColor>(m_client->currentColor().rgb()));
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(INPUT_TYPE_COLOR)
diff --git a/Source/WebKit/chromium/src/WebColorChooserClientImpl.h b/Source/WebKit/chromium/src/ColorChooserUIController.h
index d5a085da8..98adb6714 100644
--- a/Source/WebKit/chromium/src/WebColorChooserClientImpl.h
+++ b/Source/WebKit/chromium/src/ColorChooserUIController.h
@@ -23,33 +23,59 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebColorChooserClientImpl_h
-#define WebColorChooserClientImpl_h
-
-#include "WebColorChooserClient.h"
+#ifndef ColorChooserUIController_h
+#define ColorChooserUIController_h
 
 #if ENABLE(INPUT_TYPE_COLOR)
 
+#include "ColorChooser.h"
+#include "PagePopupClient.h"
+#include "WebColorChooserClient.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 class ColorChooserClient;
+class PagePopup;
 }
 
 namespace WebKit {
 
-class WebColorChooserClientImpl : public WebColorChooserClient {
+class ChromeClientImpl;
+class WebColorChooser;
+
+class ColorChooserUIController : public WebColorChooserClient, public WebCore::ColorChooser, public WebCore::PagePopupClient {
 public:
-    WebColorChooserClientImpl(WebCore::ColorChooserClient*);
-    virtual ~WebColorChooserClientImpl();
+    ColorChooserUIController(ChromeClientImpl*, WebCore::ColorChooserClient*);
+    virtual ~ColorChooserUIController();
+
+    // ColorChooser functions:
+    virtual void setSelectedColor(const WebCore::Color&) OVERRIDE;
+    virtual void endChooser() OVERRIDE;
 
+    // WebColorChooserClient functions:
     virtual void didChooseColor(const WebColor&) OVERRIDE;
     virtual void didEndChooser() OVERRIDE;
 
+    // PagePopupClient functions:
+    virtual WebCore::IntSize contentSize() OVERRIDE;
+    virtual void writeDocument(WebCore::DocumentWriter&) OVERRIDE;
+    virtual void setValueAndClosePopup(int, const String&) OVERRIDE;
+    virtual void didClosePopup() OVERRIDE;
+
 private:
+    void openPopup();
+    void closePopup();
+    void openColorChooser();
+
+    ChromeClientImpl* m_chromeClient;
     WebCore::ColorChooserClient* m_client;
+    OwnPtr<WebColorChooser> m_chooser;
+    WebCore::PagePopup* m_popup;
 };
 
 }
 
 #endif // ENABLE(INPUT_TYPE_COLOR)
 
-#endif // WebColorChooserClientImpl_h
+#endif // ColorChooserUIController_h
diff --git a/Source/WebKit/chromium/src/EditorClientImpl.cpp b/Source/WebKit/chromium/src/EditorClientImpl.cpp
index b2d060f0e..b5eaf595f 100644
--- a/Source/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/Source/WebKit/chromium/src/EditorClientImpl.cpp
@@ -49,9 +49,9 @@
 #include "WebElement.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
 #include "WebInputElement.h"
 #include "WebInputEventConversion.h"
+#include "WebKit.h"
 #include "WebNode.h"
 #include "WebPermissionClient.h"
 #include "WebRange.h"
diff --git a/Source/WebKit/chromium/src/ExternalPopupMenu.h b/Source/WebKit/chromium/src/ExternalPopupMenu.h
index aefd35e12..382bf4cbf 100644
--- a/Source/WebKit/chromium/src/ExternalPopupMenu.h
+++ b/Source/WebKit/chromium/src/ExternalPopupMenu.h
@@ -33,6 +33,8 @@
 
 #include "PopupMenu.h"
 #include "WebExternalPopupMenuClient.h"
+#include <public/WebCanvas.h>
+#include <public/WebScrollbar.h>
 
 namespace WebCore {
 class FrameView;
@@ -45,6 +47,7 @@ namespace WebKit {
 class WebExternalPopupMenu;
 class WebViewClient;
 struct WebPopupMenuInfo;
+class WebInputEvent;
 
 // The ExternalPopupMenu connects the actual implementation of the popup menu
 // to the WebCore popup menu.
@@ -76,7 +79,7 @@ private:
 
     // The actual implementor of the show menu.
     WebExternalPopupMenu* m_webExternalPopupMenu;
-}; 
+};
 
 } // namespace WebKit
 
diff --git a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index b67798e74..1e315660a 100644
--- a/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -52,7 +52,6 @@
 #include "MessageEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
-#include "PlatformString.h"
 #include "PluginData.h"
 #include "PluginDataChromium.h"
 #include "ProgressTracker.h"
@@ -69,7 +68,6 @@
 #include "WebFrameImpl.h"
 #include "WebIntentRequest.h"
 #include "WebIntentServiceInfo.h"
-#include "WebKit.h"
 #include "WebNode.h"
 #include "WebPermissionClient.h"
 #include "WebPlugin.h"
@@ -83,14 +81,15 @@
 #include "WindowFeatures.h"
 #include "WrappedResourceRequest.h"
 #include "WrappedResourceResponse.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "platform/WebURL.h"
 #include "platform/WebURLError.h"
 #include "platform/WebVector.h"
+#include <public/Platform.h>
 #include <public/WebMimeRegistry.h>
 
 #include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
 
 #if USE(V8)
 #include <v8.h>
@@ -1606,7 +1605,7 @@ bool FrameLoaderClientImpl::willCheckAndDispatchMessageEvent(
     if (event && event->source() && event->source()->document())
         source = WebFrameImpl::fromFrame(event->source()->document()->frame());
     return m_webFrame->client()->willCheckAndDispatchMessageEvent(
-        source, WebSecurityOrigin(target), WebDOMMessageEvent(event));
+        source, m_webFrame, WebSecurityOrigin(target), WebDOMMessageEvent(event));
 }
 
 #if ENABLE(WEB_INTENTS_TAG)
diff --git a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index e2c9bb9e2..c1bec1077 100755
--- a/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -43,9 +43,7 @@
 #include "WebIDBDatabaseError.h"
 #include "WebIDBFactory.h"
 #include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "WebPermissionClient.h"
-#include "platform/WebVector.h"
 #include "WebViewImpl.h"
 #include "WebWorkerBase.h"
 #include "WebWorkerClientImpl.h"
@@ -53,6 +51,8 @@
 #include "WorkerLoaderProxy.h"
 #include "WorkerScriptController.h"
 #include "WorkerThread.h"
+#include "platform/WebKitPlatformSupport.h"
+#include <public/WebVector.h>
 
 
 using namespace WebCore;
diff --git a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
index e3f7f1318..0338d3f2d 100644
--- a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
+++ b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
@@ -143,6 +143,11 @@ void InspectorFrontendClientImpl::append(const String& url, const String& conten
     m_client->append(url, content);
 }
 
+bool InspectorFrontendClientImpl::canInspectWorkers()
+{
+    return true;
+}
+
 void InspectorFrontendClientImpl::inspectedURLChanged(const String& url)
 {
     m_frontendPage->mainFrame()->document()->setTitle("Developer Tools - " + url);
diff --git a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h
index 4f66e1bcd..55e57e696 100644
--- a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h
+++ b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.h
@@ -72,6 +72,7 @@ public:
     virtual bool canSave();
     virtual void save(const WTF::String& urk, const WTF::String& content, bool forceSaveAs);
     virtual void append(const WTF::String& urk, const WTF::String& content);
+    virtual bool canInspectWorkers();
 
     virtual void inspectedURLChanged(const WTF::String&);
 
diff --git a/Source/WebKit/chromium/src/LocalizedStrings.cpp b/Source/WebKit/chromium/src/LocalizedStrings.cpp
index 081a67b8a..2a4432d8a 100644
--- a/Source/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/Source/WebKit/chromium/src/LocalizedStrings.cpp
@@ -34,11 +34,9 @@
 #include "IntSize.h"
 #include "NotImplemented.h"
 
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebString.h"
-
+#include <public/Platform.h>
 #include <public/WebLocalizedString.h>
+#include <public/WebString.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
 
@@ -215,6 +213,12 @@ String crashedPluginText()
     return String("Plug-in Failure");
 }
 
+String blockedPluginByContentSecurityPolicyText()
+{
+    notImplemented();
+    return String();
+}
+
 String insecurePluginVersionText()
 {
     notImplemented();
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
index 899315d29..fb9c12de6 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
@@ -30,10 +30,9 @@
 #include "FloatPoint.h"
 #include "FloatRect.h"
 #include "GraphicsLayer.h"
-#include "LayerChromium.h"
 #include "PlatformContextSkia.h"
 #include "WebViewImpl.h"
-#include "cc/CCLayerTreeHost.h"
+#include <public/WebContentLayer.h>
 #include <public/WebFloatPoint.h>
 
 namespace WebKit {
@@ -49,10 +48,11 @@ NonCompositedContentHost::NonCompositedContentHost(WebViewImpl* webView)
     m_graphicsLayer->setName("non-composited content");
 #endif
     m_graphicsLayer->setDrawsContent(true);
-    m_graphicsLayer->platformLayer()->setIsNonCompositedContent(true);
-    m_graphicsLayer->platformLayer()->setOpaque(true);
+    WebContentLayer layer = m_graphicsLayer->platformLayer()->to<WebContentLayer>();
+    layer.setUseLCDText(true);
+    layer.setOpaque(true);
 #if !OS(ANDROID)
-    m_graphicsLayer->platformLayer()->setDrawCheckerboardForMissingTiles(true);
+    layer.setDrawCheckerboardForMissingTiles(true);
 #endif
 }
 
@@ -77,11 +77,10 @@ void NonCompositedContentHost::setScrollLayer(WebCore::GraphicsLayer* layer)
 
     if (!layer) {
         m_graphicsLayer->removeFromParent();
-        m_graphicsLayer->platformLayer()->setLayerTreeHost(0);
         return;
     }
 
-    if (WebScrollableLayer(layer->platformLayer()) == scrollLayer())
+    if (*layer->platformLayer() == scrollLayer())
         return;
 
     layer->addChildAtIndex(m_graphicsLayer.get(), 0);
@@ -152,7 +151,7 @@ WebScrollableLayer NonCompositedContentHost::scrollLayer()
 {
     if (!m_graphicsLayer->parent())
         return WebScrollableLayer();
-    return WebScrollableLayer(m_graphicsLayer->parent()->platformLayer());
+    return m_graphicsLayer->parent()->platformLayer()->to<WebScrollableLayer>();
 }
 
 void NonCompositedContentHost::invalidateRect(const WebCore::IntRect& rect)
@@ -169,9 +168,7 @@ void NonCompositedContentHost::notifyAnimationStarted(const WebCore::GraphicsLay
 
 void NonCompositedContentHost::notifySyncRequired(const WebCore::GraphicsLayer*)
 {
-    WebCore::CCLayerTreeHost* layerTreeHost = m_graphicsLayer->platformLayer()->layerTreeHost();
-    if (layerTreeHost)
-        layerTreeHost->setNeedsCommit();
+    m_webView->scheduleCompositingLayerSync();
 }
 
 void NonCompositedContentHost::paintContents(const WebCore::GraphicsLayer*, WebCore::GraphicsContext& context, WebCore::GraphicsLayerPaintingPhase, const WebCore::IntRect& clipRect)
diff --git a/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp b/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp
index cd903c221..deb9031cc 100644
--- a/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp
+++ b/Source/WebKit/chromium/src/PlatformMessagePortChannel.cpp
@@ -35,8 +35,6 @@
 #include "ScriptExecutionContext.h"
 #include "SerializedScriptValue.h"
 
-#include "WebKit.h"
-
 #include <public/Platform.h>
 #include <public/WebMessagePortChannel.h>
 #include <public/WebString.h>
diff --git a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
index 0888e3033..aa9b189a7 100644
--- a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
+++ b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.cpp
@@ -85,23 +85,13 @@ void SpeechRecognitionClientProxy::didStartSound(const WebSpeechRecognitionHandl
 {
     RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
     recognition->didStartSound();
-}
-
-void SpeechRecognitionClientProxy::didStartSpeech(const WebSpeechRecognitionHandle& handle)
-{
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
     recognition->didStartSpeech();
 }
 
-void SpeechRecognitionClientProxy::didEndSpeech(const WebSpeechRecognitionHandle& handle)
-{
-    RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
-    recognition->didEndSpeech();
-}
-
 void SpeechRecognitionClientProxy::didEndSound(const WebSpeechRecognitionHandle& handle)
 {
     RefPtr<SpeechRecognition> recognition = PassRefPtr<SpeechRecognition>(handle);
+    recognition->didEndSpeech();
     recognition->didEndSound();
 }
 
diff --git a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
index 8063e71ed..750cbae5c 100644
--- a/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
+++ b/Source/WebKit/chromium/src/SpeechRecognitionClientProxy.h
@@ -53,8 +53,6 @@ public:
     // WebSpeechRecognizerClient:
     virtual void didStartAudio(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didStartSound(const WebSpeechRecognitionHandle&) OVERRIDE;
-    virtual void didStartSpeech(const WebSpeechRecognitionHandle&) OVERRIDE;
-    virtual void didEndSpeech(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didEndSound(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didEndAudio(const WebSpeechRecognitionHandle&) OVERRIDE;
     virtual void didReceiveResult(const WebSpeechRecognitionHandle&, const WebSpeechRecognitionResult&, unsigned long resultIndex, const WebVector<WebSpeechRecognitionResult>& resultHistory) OVERRIDE;
diff --git a/Source/WebKit/chromium/src/StorageAreaProxy.cpp b/Source/WebKit/chromium/src/StorageAreaProxy.cpp
index 576105c4d..722e80f53 100644
--- a/Source/WebKit/chromium/src/StorageAreaProxy.cpp
+++ b/Source/WebKit/chromium/src/StorageAreaProxy.cpp
@@ -120,6 +120,11 @@ bool StorageAreaProxy::canAccessStorage(Frame* frame) const
     return !webView->permissionClient() || webView->permissionClient()->allowStorage(webFrame, m_storageType == LocalStorage);
 }
 
+size_t StorageAreaProxy::memoryBytesUsedByCache() const
+{
+    return m_storageArea->memoryBytesUsedByCache();
+}
+
 void StorageAreaProxy::dispatchLocalStorageEvent(PageGroup* pageGroup, const String& key, const String& oldValue, const String& newValue,
                                                  SecurityOrigin* securityOrigin, const KURL& pageURL, WebKit::WebStorageArea* sourceAreaInstance, bool originatedInProcess)
 {
diff --git a/Source/WebKit/chromium/src/StorageAreaProxy.h b/Source/WebKit/chromium/src/StorageAreaProxy.h
index 83f2eae17..cae359358 100644
--- a/Source/WebKit/chromium/src/StorageAreaProxy.h
+++ b/Source/WebKit/chromium/src/StorageAreaProxy.h
@@ -58,6 +58,8 @@ public:
 
     virtual bool disabledByPrivateBrowsingInFrame(const Frame*) const { return false; }
 
+    virtual size_t memoryBytesUsedByCache() const;
+
     static void dispatchLocalStorageEvent(
             PageGroup*, const String& key, const String& oldValue, const String& newValue,
             SecurityOrigin*, const KURL& pageURL, WebKit::WebStorageArea* sourceAreaInstance, bool originatedInProcess);
diff --git a/Source/WebKit/chromium/src/WebAnimation.cpp b/Source/WebKit/chromium/src/WebAnimation.cpp
index 7dddfc241..610201512 100644
--- a/Source/WebKit/chromium/src/WebAnimation.cpp
+++ b/Source/WebKit/chromium/src/WebAnimation.cpp
@@ -38,6 +38,11 @@ using WebCore::CCActiveAnimation;
 
 namespace WebKit {
 
+WebAnimation::TargetProperty WebAnimation::targetProperty() const
+{
+    return static_cast<WebAnimation::TargetProperty>(m_private->targetProperty());
+}
+
 int WebAnimation::iterations() const
 {
     return m_private->iterations();
@@ -87,10 +92,12 @@ WebAnimation::operator PassOwnPtr<WebCore::CCActiveAnimation>() const
 
 void WebAnimation::initialize(const WebAnimationCurve& curve, TargetProperty targetProperty)
 {
-    m_private.reset(CCActiveAnimation::create(curve,
-                                              AnimationIdVendor::getNextAnimationId(),
-                                              AnimationIdVendor::getNextGroupId(),
-                                              static_cast<WebCore::CCActiveAnimation::TargetProperty>(targetProperty)).leakPtr());
+    initialize(curve, AnimationIdVendor::getNextAnimationId(), AnimationIdVendor::getNextGroupId(), targetProperty);
+}
+
+void WebAnimation::initialize(const WebAnimationCurve& curve, int animationId, int groupId, TargetProperty targetProperty)
+{
+    m_private.reset(CCActiveAnimation::create(curve, animationId, groupId, static_cast<WebCore::CCActiveAnimation::TargetProperty>(targetProperty)).leakPtr());
 }
 
 void WebAnimation::destroy()
diff --git a/Source/WebKit/chromium/src/WebBindings.cpp b/Source/WebKit/chromium/src/WebBindings.cpp
index 926db3b11..786a4175b 100644
--- a/Source/WebKit/chromium/src/WebBindings.cpp
+++ b/Source/WebKit/chromium/src/WebBindings.cpp
@@ -35,18 +35,20 @@
 #include "npruntime_priv.h"
 
 #if USE(V8)
-#include <wtf/ArrayBufferView.h>
+#include "BindingState.h"
 #include "DOMWindow.h"
+#include "Frame.h"
 #include "NPV8Object.h"  // for PrivateIdentifier
 #include "Range.h"
 #include "V8ArrayBuffer.h"
 #include "V8ArrayBufferView.h"
-#include "V8BindingState.h"
 #include "V8DOMWrapper.h"
 #include "V8Element.h"
 #include "V8NPUtils.h"
 #include "V8Proxy.h"
 #include "V8Range.h"
+#include <wtf/ArrayBufferView.h>
+// FIXME: Remove the USE(JSC) ifdefs because we don't support USE(JSC) anymore.
 #elif USE(JSC)
 #include "bridge/c/c_utility.h"
 #endif
@@ -288,7 +290,7 @@ static NPObject* makeIntArrayImpl(const WebVector<int>& data)
     for (size_t i = 0; i < data.size(); ++i)
         result->Set(i, v8::Number::New(data[i]));
 
-    DOMWindow* window = V8Proxy::retrieveWindow(V8Proxy::currentContext());
+    DOMWindow* window = V8Proxy::retrieveWindow(v8::Context::GetCurrent());
     return npCreateV8ScriptObject(0, result, window);
 }
 
@@ -299,7 +301,7 @@ static NPObject* makeStringArrayImpl(const WebVector<WebString>& data)
     for (size_t i = 0; i < data.size(); ++i)
         result->Set(i, data[i].data() ? v8::String::New(reinterpret_cast<const uint16_t*>((data[i].data())), data[i].length()) : v8::String::New(""));
 
-    DOMWindow* window = V8Proxy::retrieveWindow(V8Proxy::currentContext());
+    DOMWindow* window = V8Proxy::retrieveWindow(v8::Context::GetCurrent());
     return npCreateV8ScriptObject(0, result, window);
 }
 
diff --git a/Source/WebKit/chromium/src/WebColorChooserClientImpl.cpp b/Source/WebKit/chromium/src/WebColorChooserClientImpl.cpp
deleted file mode 100644
index c7ec47149..000000000
--- a/Source/WebKit/chromium/src/WebColorChooserClientImpl.cpp
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebColorChooserClientImpl.h"
-
-#include "Color.h"
-#include "ColorChooserClient.h"
-
-#if ENABLE(INPUT_TYPE_COLOR)
-
-namespace WebKit {
-
-WebColorChooserClientImpl::WebColorChooserClientImpl(WebCore::ColorChooserClient* client) : m_client(client)
-{
-}
-
-WebColorChooserClientImpl::~WebColorChooserClientImpl()
-{
-}
-
-void WebColorChooserClientImpl::didChooseColor(const WebColor& color)
-{
-    if (!m_client)
-        return;
-    m_client->didChooseColor(WebCore::Color(static_cast<WebCore::RGBA32>(color)));
-}
-
-void WebColorChooserClientImpl::didEndChooser()
-{
-    if (!m_client)
-        return;
-    m_client->didEndChooser();
-}
-
-}
-
-#endif // ENABLE(INPUT_TYPE_COLOR)
diff --git a/Source/WebKit/chromium/src/WebCompositorImpl.cpp b/Source/WebKit/chromium/src/WebCompositorImpl.cpp
deleted file mode 100644
index 369ae555a..000000000
--- a/Source/WebKit/chromium/src/WebCompositorImpl.cpp
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "WebCompositorImpl.h"
-
-#include "CCThreadImpl.h"
-#include "GraphicsContext3D.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "WebCompositorClient.h"
-#include "WebInputEvent.h"
-#include "cc/CCLayerTreeHost.h"
-#include "cc/CCProxy.h"
-#include "cc/CCSettings.h"
-#include <wtf/ThreadingPrimitives.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-bool WebCompositorImpl::s_initialized = false;
-CCThread* WebCompositorImpl::s_mainThread = 0;
-CCThread* WebCompositorImpl::s_implThread = 0;
-
-void WebCompositor::initialize(WebThread* implThread)
-{
-    WebCompositorImpl::initialize(implThread);
-}
-void WebCompositor::shutdown()
-{
-    WebCompositorImpl::shutdown();
-    CCSettings::reset();
-}
-
-void WebCompositor::setPerTilePaintingEnabled(bool enabled)
-{
-    ASSERT(!WebCompositorImpl::initialized());
-    CCSettings::setPerTilePaintingEnabled(enabled);
-}
-
-void WebCompositor::setPartialSwapEnabled(bool enabled)
-{
-    ASSERT(!WebCompositorImpl::initialized());
-    CCSettings::setPartialSwapEnabled(enabled);
-}
-
-void WebCompositor::setAcceleratedAnimationEnabled(bool enabled)
-{
-    ASSERT(!WebCompositorImpl::initialized());
-    CCSettings::setAcceleratedAnimationEnabled(enabled);
-}
-
-void WebCompositorImpl::initialize(WebThread* implThread)
-{
-    ASSERT(!s_initialized);
-    s_initialized = true;
-
-    s_mainThread = CCThreadImpl::create(WebKit::Platform::current()->currentThread()).leakPtr();
-    CCProxy::setMainThread(s_mainThread);
-    if (implThread) {
-        s_implThread = CCThreadImpl::create(implThread).leakPtr();
-        CCProxy::setImplThread(s_implThread);
-    } else
-        CCProxy::setImplThread(0);
-}
-
-bool WebCompositorImpl::initialized()
-{
-    return s_initialized;
-}
-
-void WebCompositorImpl::shutdown()
-{
-    ASSERT(s_initialized);
-    ASSERT(!CCLayerTreeHost::anyLayerTreeHostInstanceExists());
-
-    if (s_implThread) {
-        delete s_implThread;
-        s_implThread = 0;
-    }
-    delete s_mainThread;
-    s_mainThread = 0;
-    CCProxy::setImplThread(0);
-    CCProxy::setMainThread(0);
-    s_initialized = false;
-}
-
-}
diff --git a/Source/WebKit/chromium/src/WebCompositorImpl.h b/Source/WebKit/chromium/src/WebCompositorImpl.h
deleted file mode 100644
index 34c6bd0fd..000000000
--- a/Source/WebKit/chromium/src/WebCompositorImpl.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebCompositorImpl_h
-#define WebCompositorImpl_h
-
-#include "WebCompositor.h"
-
-#include <wtf/HashSet.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-
-namespace WebCore {
-class CCThread;
-}
-
-namespace WebKit {
-
-class WebThread;
-
-class WebCompositorImpl : public WebCompositor {
-    WTF_MAKE_NONCOPYABLE(WebCompositorImpl);
-public:
-    static bool initialized();
-
-private:
-
-    friend class WebCompositor;
-    static void initialize(WebThread* implThread);
-    static void shutdown();
-
-    static bool s_initialized;
-    static WebCore::CCThread* s_mainThread;
-    static WebCore::CCThread* s_implThread;
-};
-
-}
-
-#endif // WebCompositorImpl_h
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
index 63bf270fe..25b31d5e9 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.cpp
@@ -33,10 +33,8 @@
 #include "WebCompositorImpl.h"
 #include "WebCompositorInputHandlerClient.h"
 #include "WebInputEvent.h"
-#include "WebKit.h"
 #include "cc/CCActiveGestureAnimation.h"
 #include "cc/CCProxy.h"
-#include "platform/WebKitPlatformSupport.h"
 #include <wtf/ThreadingPrimitives.h>
 
 using namespace WebCore;
diff --git a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
index 64647105b..6bb09ab5c 100644
--- a/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
+++ b/Source/WebKit/chromium/src/WebCompositorInputHandlerImpl.h
@@ -27,11 +27,11 @@
 #define WebCompositorInputHandlerImpl_h
 
 #include "WebActiveWheelFlingParameters.h"
-#include "WebCompositor.h"
 #include "WebCompositorInputHandler.h"
 #include "WebInputEvent.h"
 #include "cc/CCGestureCurve.h"
 #include "cc/CCInputHandler.h"
+#include <public/WebCompositor.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
diff --git a/Source/WebKit/chromium/src/WebContentLayer.cpp b/Source/WebKit/chromium/src/WebContentLayer.cpp
index 14ce98039..efa7465b1 100644
--- a/Source/WebKit/chromium/src/WebContentLayer.cpp
+++ b/Source/WebKit/chromium/src/WebContentLayer.cpp
@@ -53,6 +53,16 @@ void WebContentLayer::setContentsScale(float scale)
     m_private->setContentsScale(scale);
 }
 
+void WebContentLayer::setUseLCDText(bool enable)
+{
+    m_private->setUseLCDText(enable);
+}
+
+void WebContentLayer::setDrawCheckerboardForMissingTiles(bool enable)
+{
+    m_private->setDrawCheckerboardForMissingTiles(enable);
+}
+
 WebContentLayer::WebContentLayer(const PassRefPtr<ContentLayerChromium>& node)
     : WebScrollableLayer(node)
 {
diff --git a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
index ecf099a4a..69da1ea3f 100644
--- a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
@@ -26,12 +26,9 @@
 #include "config.h"
 #include "WebContentLayerImpl.h"
 
-#include "platform/WebContentLayerClient.h"
-#include "platform/WebFloatRect.h"
-#include "platform/WebRect.h"
-#include "GraphicsContext.h"
-#include "platform/WebCanvas.h"
-#include "PlatformContextSkia.h"
+#include <public/WebContentLayerClient.h>
+#include <public/WebFloatRect.h>
+#include <public/WebRect.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 7a4617ddc..d4366f99a 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -423,8 +423,8 @@ void WebDevToolsAgentImpl::didCreateScriptContext(WebFrameImpl* webframe, int wo
     // Skip non main world contexts.
     if (worldId)
         return;
-    if (WebCore::V8Proxy* proxy = WebCore::V8Proxy::retrieve(webframe->frame()))
-        proxy->setContextDebugId(m_hostId);
+    if (WebCore::Frame* frame = webframe->frame())
+        frame->script()->proxy()->setContextDebugId(m_hostId);
 }
 
 void WebDevToolsAgentImpl::mainFrameViewCreated(WebFrameImpl* webFrame)
diff --git a/Source/WebKit/chromium/src/WebDocument.cpp b/Source/WebKit/chromium/src/WebDocument.cpp
index 063f71892..691701715 100644
--- a/Source/WebKit/chromium/src/WebDocument.cpp
+++ b/Source/WebKit/chromium/src/WebDocument.cpp
@@ -44,6 +44,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLHeadElement.h"
 #include "NodeList.h"
+#include "RenderObject.h"
 #include "SecurityOrigin.h"
 #include "StyleSheetContents.h"
 #include "WebAccessibilityObject.h"
@@ -228,6 +229,15 @@ WebReferrerPolicy WebDocument::referrerPolicy() const
     return static_cast<WebReferrerPolicy>(constUnwrap<Document>()->referrerPolicy());
 }
 
+WebElement WebDocument::createElement(const WebString& tagName)
+{
+    ExceptionCode ec = 0;
+    WebElement element(unwrap<Document>()->createElement(tagName, ec));
+    if (ec)
+        return WebElement();
+    return element;
+}
+
 WebAccessibilityObject WebDocument::accessibilityObject() const
 {
     const Document* document = constUnwrap<Document>();
@@ -242,6 +252,25 @@ WebAccessibilityObject WebDocument::accessibilityObjectFromID(int axID) const
         document->axObjectCache()->objectFromAXID(axID));
 }
 
+WebVector<WebDraggableRegion> WebDocument::draggableRegions() const
+{
+    WebVector<WebDraggableRegion> draggableRegions;
+#if ENABLE(WIDGET_REGION)
+    const Document* document = constUnwrap<Document>();
+    if (document->hasDashboardRegions()) {
+        const Vector<DashboardRegionValue>& regions = document->dashboardRegions();
+        draggableRegions = WebVector<WebDraggableRegion>(regions.size());
+        for (size_t i = 0; i < regions.size(); i++) {
+            const DashboardRegionValue& value = regions[i];
+            draggableRegions[i].label = value.label;
+            draggableRegions[i].bounds = WebCore::IntRect(value.bounds);
+            draggableRegions[i].clip = WebCore::IntRect(value.clip);
+        }
+    }
+#endif
+    return draggableRegions;
+}
+
 WebDocument::WebDocument(const PassRefPtr<Document>& elem)
     : WebNode(elem)
 {
diff --git a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
index d9cea3bb1..bbd1f8ddb 100644
--- a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
+++ b/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
@@ -27,7 +27,7 @@
 #include <public/WebExternalTextureLayer.h>
 
 #include "TextureLayerChromium.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include <public/WebExternalTextureLayerClient.h>
 #include <public/WebFloatRect.h>
 #include <public/WebSize.h>
@@ -38,18 +38,19 @@ namespace WebKit {
 
 class WebTextureUpdaterImpl : public WebTextureUpdater {
 public:
-    explicit WebTextureUpdaterImpl(CCTextureUpdater& updater)
-        : m_updater(updater)
+    explicit WebTextureUpdaterImpl(CCTextureUpdateQueue& queue)
+        : m_queue(queue)
     {
     }
 
     virtual void appendCopy(unsigned sourceTexture, unsigned destinationTexture, WebSize size) OVERRIDE
     {
-        m_updater.appendCopy(sourceTexture, destinationTexture, size);
+        TextureCopier::Parameters copy = { sourceTexture, destinationTexture, size };
+        m_queue.appendCopy(copy);
     }
 
 private:
-    CCTextureUpdater& m_updater;
+    CCTextureUpdateQueue& m_queue;
 };
 
 class WebExternalTextureLayerImpl : public TextureLayerChromiumClient, public TextureLayerChromium {
@@ -60,9 +61,9 @@ public:
     {
     }
 
-    virtual unsigned prepareTexture(CCTextureUpdater& updater) OVERRIDE
+    virtual unsigned prepareTexture(CCTextureUpdateQueue& queue) OVERRIDE
     {
-        WebTextureUpdaterImpl updaterImpl(updater);
+        WebTextureUpdaterImpl updaterImpl(queue);
         return m_client->prepareTexture(updaterImpl);
     }
 
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index f821562f6..fb2a29540 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -169,6 +169,8 @@
 #include "XPathResult.h"
 #include "markup.h"
 #include "painting/GraphicsContextBuilder.h"
+#include "platform/WebFloatPoint.h"
+#include "platform/WebFloatRect.h"
 #include "platform/WebPoint.h"
 #include "platform/WebRect.h"
 #include "platform/WebSerializedScriptValue.h"
@@ -588,6 +590,16 @@ WebString WebFrameImpl::name() const
     return m_frame->tree()->uniqueName();
 }
 
+WebString WebFrameImpl::uniqueName() const
+{
+    return m_frame->tree()->uniqueName();
+}
+
+WebString WebFrameImpl::assignedName() const
+{
+    return m_frame->tree()->name();
+}
+
 void WebFrameImpl::setName(const WebString& name)
 {
     m_frame->tree()->setName(name);
@@ -1446,11 +1458,22 @@ bool WebFrameImpl::selectWordAroundCaret()
 
 void WebFrameImpl::selectRange(const WebPoint& start, const WebPoint& end)
 {
-    VisibleSelection selection(visiblePositionForWindowPoint(start),
-                               visiblePositionForWindowPoint(end));
+    VisiblePosition startPosition = visiblePositionForWindowPoint(start);
+    VisiblePosition endPosition = visiblePositionForWindowPoint(end);
+
+    // To correctly handle editable boundaries, we adjust the selection by setting its extent
+    // while keeping its base fixed. For a touch-based UI, this means that moving the selection
+    // handles behaves like a drag-select with the mouse, which is what we want here. If both
+    // endpoints changed, we need to set the extent twice.
+    // FIXME: the WebFrame::SelectRange API should explicitly state which endpoint is moving.
+    VisibleSelection newSelection = frame()->selection()->selection();
+    if (startPosition != newSelection.visibleStart())
+        newSelection = VisibleSelection(newSelection.visibleEnd(), startPosition);
+    if (endPosition != newSelection.visibleEnd())
+        newSelection = VisibleSelection(newSelection.visibleStart(), endPosition);
 
-    if (frame()->selection()->shouldChangeSelection(selection))
-        frame()->selection()->setSelection(selection, CharacterGranularity);
+    if (frame()->selection()->shouldChangeSelection(newSelection))
+        frame()->selection()->setSelection(newSelection, CharacterGranularity);
 }
 
 void WebFrameImpl::selectRange(const WebRange& webRange)
@@ -1472,13 +1495,9 @@ VisiblePosition WebFrameImpl::visiblePositionForWindowPoint(const WebPoint& poin
 
     frame()->document()->renderView()->layer()->hitTest(request, result);
 
-    // Matching the logic in MouseEventWithHitTestResults::targetNode()
-    Node* node = result.innerNode();
+    Node* node = EventHandler::targetNode(result);
     if (!node)
         return VisiblePosition();
-    Element* element = node->parentElement();
-    if (!node->inDocument() && element && element->inDocument())
-        node = element;
 
     return node->renderer()->positionForPoint(result.localPoint());
 }
@@ -1938,6 +1957,29 @@ void WebFrameImpl::dispatchMessageEventWithOriginCheck(const WebSecurityOrigin&
     m_frame->domWindow()->dispatchMessageEventWithOriginCheck(intendedTargetOrigin.get(), event, 0);
 }
 
+int WebFrameImpl::findMatchMarkersVersion() const
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+    return 0;
+}
+
+WebFloatRect WebFrameImpl::activeFindMatchRect()
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+    return WebFloatRect();
+}
+
+void WebFrameImpl::findMatchRects(WebVector<WebFloatRect>& outputRects)
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+}
+
+int WebFrameImpl::selectNearestFindMatch(const WebFloatPoint& point, WebRect* selectionRect)
+{
+    // FIXME: Implement this as part of https://bugs.webkit.org/show_bug.cgi?id=93111.
+    return 0;
+}
+
 void WebFrameImpl::deliverIntent(const WebIntent& intent, WebMessagePortChannelArray* ports, WebDeliveredIntentClient* intentClient)
 {
 #if ENABLE(WEB_INTENTS)
@@ -2001,21 +2043,6 @@ WebString WebFrameImpl::markerTextForListItem(const WebElement& webElement) cons
     return WebCore::markerTextForListItem(const_cast<Element*>(webElement.constUnwrap<Element>()));
 }
 
-int WebFrameImpl::pageNumberForElementById(const WebString& id,
-                                           float pageWidthInPixels,
-                                           float pageHeightInPixels) const
-{
-    if (!m_frame)
-        return -1;
-
-    Element* element = m_frame->document()->getElementById(id);
-    if (!element)
-        return -1;
-
-    FloatSize pageSize(pageWidthInPixels, pageHeightInPixels);
-    return PrintContext::pageNumberForElement(element, pageSize);
-}
-
 void WebFrameImpl::printPagesWithBoundaries(WebCanvas* canvas, const WebSize& pageSizeInPixels)
 {
     ASSERT(m_printContext.get());
@@ -2142,6 +2169,9 @@ PassRefPtr<Frame> WebFrameImpl::createChildFrame(
     if (!childFrame->tree()->parent())
         return 0;
 
+    if (m_client)
+        m_client->didCreateFrame(this, webframe.get());
+
     return childFrame.release();
 }
 
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index 9dbf68336..0aba56f4c 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -72,6 +72,8 @@ class WebFrameImpl : public WebFrame, public RefCounted<WebFrameImpl> {
 public:
     // WebFrame methods:
     virtual WebString name() const;
+    virtual WebString uniqueName() const;
+    virtual WebString assignedName() const;
     virtual void setName(const WebString&);
     virtual long long identifier() const;
     virtual WebVector<WebIconURL> iconURLs(int iconTypes) const;
@@ -210,6 +212,10 @@ public:
     virtual void cancelPendingScopingEffort();
     virtual void increaseMatchCount(int count, int identifier);
     virtual void resetMatchCount();
+    virtual int findMatchMarkersVersion() const;
+    virtual WebFloatRect activeFindMatchRect();
+    virtual void findMatchRects(WebVector<WebFloatRect>&);
+    virtual int selectNearestFindMatch(const WebFloatPoint&, WebRect* selectionRect);
 
     virtual void sendOrientationChangeEvent(int orientation);
 
@@ -228,9 +234,6 @@ public:
     virtual WebString contentAsMarkup() const;
     virtual WebString renderTreeAsText(RenderAsTextControls toShow = RenderAsTextNormal) const;
     virtual WebString markerTextForListItem(const WebElement&) const;
-    virtual int pageNumberForElementById(const WebString& id,
-                                         float pageWidthInPixels,
-                                         float pageHeightInPixels) const;
     virtual WebRect selectionBoundsRect() const;
 
     virtual bool selectionStartHasSpellingMarkerFor(int from, int length) const;
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 22a066807..c327eba84 100755
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -106,8 +106,9 @@ void WebIDBObjectStoreImpl::deleteIndex(const WebString& name, const WebIDBTrans
     m_objectStore->deleteIndex(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, WebIDBCursor::Direction direction, WebIDBCallbacks* callbacks, WebIDBTransaction::TaskType, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
+    // FIXME: Pass along TaskType when the API becomes available.
     m_objectStore->openCursor(keyRange, direction, IDBCallbacksProxy::create(adoptPtr(callbacks)), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
diff --git a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index 934cffa99..482b22380 100644
--- a/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -54,7 +54,11 @@ public:
     WebIDBIndex* index(const WebString& name, WebExceptionCode&);
     void deleteIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
 
-    void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void openCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
+    {
+        openCursor(range, static_cast<WebIDBCursor::Direction>(direction), callbacks, WebIDBTransaction::NormalTask, transaction, ec);
+    }
+    void openCursor(const WebIDBKeyRange&, WebIDBCursor::Direction, WebIDBCallbacks*, WebIDBTransaction::TaskType, const WebIDBTransaction&, WebExceptionCode&);
     void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
  private:
diff --git a/Source/WebKit/chromium/src/WebImageCG.cpp b/Source/WebKit/chromium/src/WebImageCG.cpp
deleted file mode 100644
index 242a68304..000000000
--- a/Source/WebKit/chromium/src/WebImageCG.cpp
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "Image.h"
-#include "ImageSource.h"
-#include "SharedBuffer.h"
-
-#include "platform/WebData.h"
-#include "platform/WebSize.h"
-
-#include <CoreGraphics/CGImage.h>
-
-#include <public/WebImage.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RetainPtr.h>
-
-using namespace WebCore;
-
-namespace WebKit {
-
-WebImage WebImage::fromData(const WebData& data, const WebSize& desiredSize)
-{
-    ImageSource source;
-    source.setData(PassRefPtr<SharedBuffer>(data).get(), true);
-    if (!source.isSizeAvailable())
-        return WebImage();
-
-    // Frames are arranged by decreasing size, then decreasing bit depth.
-    // Pick the frame closest to |desiredSize|'s area without being smaller,
-    // which has the highest bit depth.
-    const size_t frameCount = source.frameCount();
-    size_t index = 0; // Default to first frame if none are large enough.
-    int frameAreaAtIndex = 0;
-    for (size_t i = 0; i < frameCount; ++i) {
-        const IntSize frameSize = source.frameSizeAtIndex(i);
-        if (WebSize(frameSize) == desiredSize) {
-            index = i;
-            break; // Perfect match.
-        }
-        const int frameArea = frameSize.width() * frameSize.height();
-        if (frameArea < (desiredSize.width * desiredSize.height))
-            break; // No more frames that are large enough.
-
-        if (!i || (frameArea < frameAreaAtIndex)) {
-            index = i; // Closer to desired area than previous best match.
-            frameAreaAtIndex = frameArea;
-        }
-    }
-
-    RetainPtr<CGImageRef> frame(AdoptCF, source.createFrameAtIndex(index));
-    if (!frame)
-        return WebImage();
-
-    return WebImage(frame.get());
-}
-
-void WebImage::reset()
-{
-    CGImageRelease(m_imageRef);
-    m_imageRef = 0;
-}
-
-void WebImage::assign(const WebImage& image)
-{
-    assign(image.m_imageRef);
-}
-
-bool WebImage::isNull() const
-{
-    return !m_imageRef;
-}
-
-WebSize WebImage::size() const
-{
-    return WebSize(CGImageGetWidth(m_imageRef), CGImageGetHeight(m_imageRef));
-}
-
-WebImage::WebImage(const PassRefPtr<Image>& image)
-    : m_imageRef(0)
-{
-    NativeImagePtr p;
-    if (image && (p = image->nativeImageForCurrentFrame()))
-        assign(p);
-}
-
-WebImage& WebImage::operator=(const PassRefPtr<Image>& image)
-{
-    NativeImagePtr p;
-    if (image && (p = image->nativeImageForCurrentFrame()))
-        assign(p);
-    else
-        reset();
-    return *this;
-}
-
-void WebImage::assign(CGImageRef imageRef)
-{
-    // Make sure to retain the imageRef first incase m_imageRef == imageRef.
-    CGImageRetain(imageRef);
-    CGImageRelease(m_imageRef);
-    m_imageRef = imageRef;
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebImageSkia.cpp b/Source/WebKit/chromium/src/WebImageSkia.cpp
index 36dabac3e..e1a926050 100644
--- a/Source/WebKit/chromium/src/WebImageSkia.cpp
+++ b/Source/WebKit/chromium/src/WebImageSkia.cpp
@@ -38,10 +38,12 @@
 #include "platform/WebData.h"
 #include "platform/WebSize.h"
 
+#include <algorithm>
 #include <public/WebImage.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
 
 using namespace WebCore;
 
@@ -84,6 +86,36 @@ WebImage WebImage::fromData(const WebData& data, const WebSize& desiredSize)
     return WebImage(frame->bitmap());
 }
 
+WebVector<WebImage> WebImage::framesFromData(const WebData& data)
+{
+    // This is to protect from malicious images. It should be big enough that it's never hit in pracice.
+    const size_t maxFrameCount = 8;
+
+    ImageSource source;
+    source.setData(PassRefPtr<SharedBuffer>(data).get(), true);
+    if (!source.isSizeAvailable())
+        return WebVector<WebImage>();
+
+    // Frames are arranged by decreasing size, then decreasing bit depth.
+    // Keep the first frame at every size, has the highest bit depth.
+    const size_t frameCount = source.frameCount();
+    IntSize lastSize;
+
+    Vector<WebImage> frames;
+    for (size_t i = 0; i < std::min(frameCount, maxFrameCount); ++i) {
+        const IntSize frameSize = source.frameSizeAtIndex(i);
+        if (frameSize == lastSize)
+            continue;
+        lastSize = frameSize;
+
+        OwnPtr<NativeImageSkia> frame = adoptPtr(source.createFrameAtIndex(i));
+        if (frame)
+            frames.append(WebImage(frame->bitmap()));
+    }
+
+    return frames;
+}
+
 void WebImage::reset()
 {
     m_bitmap.reset();
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.cpp b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
index 207d81ca3..0391c285b 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.cpp
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.cpp
@@ -32,6 +32,7 @@
 #include "WebInputEventConversion.h"
 
 #include "EventNames.h"
+#include "GestureEvent.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
@@ -151,7 +152,7 @@ PlatformGestureEventBuilder::PlatformGestureEventBuilder(Widget* widget, const W
         break;
     case WebInputEvent::GestureTap:
         m_type = PlatformEvent::GestureTap;
-        m_area = IntSize(e.deltaX * 2, e.deltaY * 2);
+        m_area = IntSize(e.boundingBox.width, e.boundingBox.height);
         break;
     case WebInputEvent::GestureTapDown:
         m_type = PlatformEvent::GestureTapDown;
@@ -164,6 +165,7 @@ PlatformGestureEventBuilder::PlatformGestureEventBuilder(Widget* widget, const W
         break;
     case WebInputEvent::GestureLongPress:
         m_type = PlatformEvent::GestureLongPress;
+        m_area = IntSize(e.boundingBox.width, e.boundingBox.height);
         break;
     case WebInputEvent::GesturePinchBegin:
         m_type = PlatformEvent::GesturePinchBegin;
@@ -462,6 +464,7 @@ WebKeyboardEventBuilder::WebKeyboardEventBuilder(const KeyboardEvent& event)
         text[i] = event.keyEvent()->text()[i];
         unmodifiedText[i] = event.keyEvent()->unmodifiedText()[i];
     }
+    memcpy(keyIdentifier, event.keyIdentifier().ascii().data(), event.keyIdentifier().length());
 }
 
 #if ENABLE(TOUCH_EVENTS)
@@ -512,4 +515,31 @@ WebTouchEventBuilder::WebTouchEventBuilder(const Widget* widget, const TouchEven
 
 #endif // ENABLE(TOUCH_EVENTS)
 
+#if ENABLE(GESTURE_EVENTS)
+WebGestureEventBuilder::WebGestureEventBuilder(const Widget* widget, const GestureEvent& event)
+{
+    if (event.type() == eventNames().gesturetapEvent)
+        type = GestureTap;
+    else if (event.type() == eventNames().gesturetapdownEvent)
+        type = GestureTapDown;
+    else if (event.type() == eventNames().gesturescrollstartEvent)
+        type = GestureScrollBegin;
+    else if (event.type() == eventNames().gesturescrollendEvent)
+        type = GestureScrollEnd;
+    else if (event.type() == eventNames().gesturescrollupdateEvent)
+        type = GestureScrollUpdate;
+
+    timeStampSeconds = event.timeStamp() / millisPerSecond;
+    modifiers = getWebInputModifiers(event);
+
+    globalX = event.screenX();
+    globalY = event.screenY();
+    x = event.absoluteLocation().x() - widget->location().x();
+    y = event.absoluteLocation().y() - widget->location().y();
+
+    deltaX = event.deltaX();
+    deltaY = event.deltaY();
+}
+#endif // ENABLE(GESTURE_EVENTS)
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebInputEventConversion.h b/Source/WebKit/chromium/src/WebInputEventConversion.h
index d47bda814..48975a404 100644
--- a/Source/WebKit/chromium/src/WebInputEventConversion.h
+++ b/Source/WebKit/chromium/src/WebInputEventConversion.h
@@ -39,6 +39,7 @@
 #include "WebInputEvent.h"
 
 namespace WebCore {
+class GestureEvent;
 class KeyboardEvent;
 class MouseEvent;
 class ScrollView;
@@ -131,6 +132,15 @@ public:
 };
 #endif // ENABLE(TOUCH_EVENTS)
 
+#if ENABLE(GESTURE_EVENTS)
+// Converts WebCore::GestureEvent to a corresponding WebGestureEvent.
+// NOTE: If event mapping fails, the type will be set to Undefined.
+class WebGestureEventBuilder : public WebGestureEvent {
+public:
+    WebGestureEventBuilder(const WebCore::Widget*, const WebCore::GestureEvent&);
+};
+#endif // ENABLE(GESTURE_EVENTS)
+
 } // namespace WebKit
 
 #endif
diff --git a/Source/WebKit/chromium/src/WebKit.cpp b/Source/WebKit/chromium/src/WebKit.cpp
index a3f0f8391..9331d053a 100644
--- a/Source/WebKit/chromium/src/WebKit.cpp
+++ b/Source/WebKit/chromium/src/WebKit.cpp
@@ -105,7 +105,7 @@ void initialize(WebKitPlatformSupport* webKitPlatformSupport)
 
     v8::V8::SetEntropySource(&generateEntropy);
     v8::V8::Initialize();
-    WebCore::V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
+    WebCore::V8PerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
 
 #if ENABLE(MUTATION_OBSERVERS)
     // currentThread will always be non-null in production, but can be null in Chromium unit tests.
diff --git a/Source/WebKit/chromium/src/WebLayer.cpp b/Source/WebKit/chromium/src/WebLayer.cpp
index 5b8d55cf4..d77c25eb9 100644
--- a/Source/WebKit/chromium/src/WebLayer.cpp
+++ b/Source/WebKit/chromium/src/WebLayer.cpp
@@ -24,12 +24,10 @@
  */
 
 #include "config.h"
-#include "platform/WebLayer.h"
+#include <public/WebLayer.h>
 
-#include "Color.h"
 #include "LayerChromium.h"
 #include "SkMatrix44.h"
-#include "TransformationMatrix.h"
 #include "WebLayerImpl.h"
 #include <public/WebFilterOperations.h>
 #include <public/WebFloatPoint.h>
@@ -144,6 +142,14 @@ void WebLayer::replaceChild(const WebLayer& reference, const WebLayer& newLayer)
     m_private->replaceChild(ref.unwrap<LayerChromium>(), newLayer);
 }
 
+void WebLayer::setChildren(const WebVector<WebLayer>& webChildren)
+{
+    Vector<RefPtr<LayerChromium> > children(webChildren.size());
+    for (size_t i = 0; i < webChildren.size(); ++i)
+        children[i] = webChildren[i].unwrap<LayerChromium>();
+    m_private->setChildren(children);
+}
+
 void WebLayer::removeFromParent()
 {
     m_private->removeFromParent();
@@ -205,6 +211,12 @@ WebLayer WebLayer::maskLayer() const
     return WebLayer(m_private->maskLayer());
 }
 
+void WebLayer::setReplicaLayer(const WebLayer& replicaLayer)
+{
+    WebLayer ref = replicaLayer;
+    m_private->setReplicaLayer(ref.unwrap<LayerChromium>());
+}
+
 void WebLayer::setOpacity(float opacity)
 {
     m_private->setOpacity(opacity);
@@ -310,6 +322,53 @@ void WebLayer::setDebugBorderWidth(float width)
     m_private->setDebugBorderWidth(width);
 }
 
+void WebLayer::setDebugName(WebString name)
+{
+    m_private->setDebugName(name);
+}
+
+void WebLayer::setAnimationDelegate(WebAnimationDelegate* delegate)
+{
+    m_private->setLayerAnimationDelegate(delegate);
+}
+
+bool WebLayer::addAnimation(const WebAnimation& animation)
+{
+    return m_private->addAnimation(animation);
+}
+
+void WebLayer::removeAnimation(int animationId)
+{
+    m_private->removeAnimation(animationId);
+}
+
+void WebLayer::removeAnimation(int animationId, WebAnimation::TargetProperty targetProperty)
+{
+    m_private->layerAnimationController()->removeAnimation(animationId, static_cast<CCActiveAnimation::TargetProperty>(targetProperty));
+}
+
+void WebLayer::pauseAnimation(int animationId, double timeOffset)
+{
+    m_private->pauseAnimation(animationId, timeOffset);
+}
+
+void WebLayer::suspendAnimations(double monotonicTime)
+{
+    m_private->suspendAnimations(monotonicTime);
+}
+
+void WebLayer::resumeAnimations(double monotonicTime)
+{
+    m_private->resumeAnimations(monotonicTime);
+}
+
+void WebLayer::transferAnimationsTo(WebLayer* other)
+{
+    ASSERT(other);
+    if (other)
+        other->m_private->setLayerAnimationController(m_private->releaseLayerAnimationController());
+}
+
 void WebLayer::setAlwaysReserveTextures(bool reserve)
 {
     m_private->setAlwaysReserveTextures(reserve);
@@ -320,6 +379,11 @@ void WebLayer::setForceRenderSurface(bool forceRenderSurface)
     m_private->setForceRenderSurface(forceRenderSurface);
 }
 
+void WebLayer::clearRenderSurface()
+{
+    m_private->clearRenderSurface();
+}
+
 WebLayer::WebLayer(const PassRefPtr<LayerChromium>& node)
     : m_private(node)
 {
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index b87df0f1b..edd43df20 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -24,19 +24,19 @@
  */
 
 #include "config.h"
-#include "platform/WebLayerTreeView.h"
+#include <public/WebLayerTreeView.h>
 
-#include "GraphicsContext3DPrivate.h"
 #include "LayerChromium.h"
 #include "WebLayerTreeViewImpl.h"
+#include "cc/CCFontAtlas.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCRenderingStats.h"
-#include "platform/WebLayer.h"
-#include "platform/WebPoint.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
+#include <public/WebLayer.h>
+#include <public/WebPoint.h>
+#include <public/WebRect.h>
 #include <public/WebRenderingStats.h>
+#include <public/WebSize.h>
 
 using namespace WebCore;
 
@@ -45,10 +45,10 @@ namespace WebKit {
 WebLayerTreeView::Settings::operator CCLayerTreeSettings() const
 {
     CCLayerTreeSettings settings;
-    settings.forceSoftwareCompositing = forceSoftwareCompositing;
     settings.showFPSCounter = showFPSCounter;
     settings.showPlatformLayerTree = showPlatformLayerTree;
     settings.showPaintRects = showPaintRects;
+    settings.renderVSyncEnabled = renderVSyncEnabled;
     settings.refreshRate = refreshRate;
     settings.defaultTileSize = defaultTileSize;
     settings.maxUntiledLayerSize = maxUntiledLayerSize;
@@ -93,14 +93,22 @@ int WebLayerTreeView::compositorIdentifier()
     return m_private->layerTreeHost()->compositorIdentifier();
 }
 
-void WebLayerTreeView::setViewportSize(const WebSize& viewportSize)
+void WebLayerTreeView::setViewportSize(const WebSize& layoutViewportSize, const WebSize& deviceViewportSize)
 {
-    m_private->layerTreeHost()->setViewportSize(viewportSize);
+    if (!deviceViewportSize.isEmpty())
+        m_private->layerTreeHost()->setViewportSize(layoutViewportSize, deviceViewportSize);
+    else
+        m_private->layerTreeHost()->setViewportSize(layoutViewportSize, layoutViewportSize);
+}
+
+WebSize WebLayerTreeView::layoutViewportSize() const
+{
+    return WebSize(m_private->layerTreeHost()->layoutViewportSize());
 }
 
-WebSize WebLayerTreeView::viewportSize() const
+WebSize WebLayerTreeView::deviceViewportSize() const
 {
-    return WebSize(m_private->layerTreeHost()->viewportSize());
+    return WebSize(m_private->layerTreeHost()->deviceViewportSize());
 }
 
 void WebLayerTreeView::setDeviceScaleFactor(const float deviceScaleFactor)
@@ -188,6 +196,15 @@ void WebLayerTreeView::renderingStats(WebRenderingStats& stats) const
     stats.totalRasterizeTimeInSeconds = ccStats.totalRasterizeTimeInSeconds;
 }
 
+void WebLayerTreeView::setFontAtlas(SkBitmap bitmap, WebRect asciiToWebRectTable[128], int fontHeight)
+{
+    IntRect asciiToRectTable[128];
+    for (int i = 0; i < 128; ++i)
+        asciiToRectTable[i] = asciiToWebRectTable[i];
+    OwnPtr<CCFontAtlas> fontAtlas = CCFontAtlas::create(bitmap, asciiToRectTable, fontHeight);
+    m_private->layerTreeHost()->setFontAtlas(fontAtlas.release());
+}
+
 void WebLayerTreeView::loseCompositorContext(int numTimes)
 {
     m_private->layerTreeHost()->loseContext(numTimes);
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
index 825fc01ef..a7bf64d36 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
@@ -26,26 +26,71 @@
 #include "config.h"
 #include "WebLayerTreeViewImpl.h"
 
-#include "CCThreadImpl.h"
-#include "GraphicsContext3DPrivate.h"
 #include "LayerChromium.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCThreadProxy.h"
-#include "platform/WebGraphicsContext3D.h"
-#include "platform/WebLayer.h"
-#include "platform/WebLayerTreeView.h"
-#include "platform/WebLayerTreeViewClient.h"
-#include "platform/WebSize.h"
-#include "platform/WebThread.h"
+#include <public/WebGraphicsContext3D.h>
+#include <public/WebLayer.h>
+#include <public/WebLayerTreeView.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebSize.h>
+#include <public/WebThread.h>
 
 using namespace WebCore;
 
+namespace {
+
+// Adapts a pure WebGraphicsContext3D into a WebCompositorOutputSurface until
+// downstream code can be updated to produce output surfaces directly.
+class WebGraphicsContextToOutputSurfaceAdapter : public WebKit::WebCompositorOutputSurface {
+public:
+    explicit WebGraphicsContextToOutputSurfaceAdapter(PassOwnPtr<WebKit::WebGraphicsContext3D> context)
+        : m_context3D(context)
+        , m_client(0)
+    {
+    }
+
+    virtual bool bindToClient(WebKit::WebCompositorOutputSurfaceClient* client) OVERRIDE
+    {
+        ASSERT(client);
+        if (!m_context3D->makeContextCurrent())
+            return false;
+        m_client = client;
+        return true;
+    }
+
+    virtual const Capabilities& capabilities() const OVERRIDE
+    {
+        return m_capabilities;
+    }
+
+    virtual WebKit::WebGraphicsContext3D* context3D() const OVERRIDE
+    {
+        return m_context3D.get();
+    }
+
+    virtual void sendFrameToParentCompositor(const WebKit::WebCompositorFrame&) OVERRIDE
+    {
+    }
+
+private:
+    OwnPtr<WebKit::WebGraphicsContext3D> m_context3D;
+    Capabilities m_capabilities;
+    WebKit::WebCompositorOutputSurfaceClient* m_client;
+};
+
+}
+
 namespace WebKit {
 
 // Converts messages from CCLayerTreeHostClient to WebLayerTreeViewClient.
 class WebLayerTreeViewClientAdapter : public WebCore::CCLayerTreeHostClient {
 public:
-    WebLayerTreeViewClientAdapter(WebLayerTreeViewClient* client) : m_client(client) { }
+    WebLayerTreeViewClientAdapter(WebLayerTreeViewClient* client)
+        : m_client(client)
+        , m_usingRealOutputSurface(false)
+    {
+    }
     virtual ~WebLayerTreeViewClientAdapter() { }
 
     // CCLayerTreeHostClient implementation
@@ -54,11 +99,33 @@ public:
     virtual void updateAnimations(double monotonicFrameBeginTime) OVERRIDE { m_client->updateAnimations(monotonicFrameBeginTime); }
     virtual void layout() OVERRIDE { m_client->layout(); }
     virtual void applyScrollAndScale(const WebCore::IntSize& scrollDelta, float pageScale) OVERRIDE { m_client->applyScrollAndScale(scrollDelta, pageScale); }
-    virtual PassOwnPtr<WebGraphicsContext3D> createContext3D() OVERRIDE
+    virtual PassOwnPtr<WebCompositorOutputSurface> createOutputSurface() OVERRIDE
+    {
+        WebCompositorOutputSurface* outputSurface = m_client->createOutputSurface();
+        if (outputSurface) {
+            m_usingRealOutputSurface = true;
+            return adoptPtr(outputSurface);
+        }
+
+        // Temporarily, if the output surface can't be created, create a WebGraphicsContext3D
+        // directly. This allows bootstrapping the output surface system while downstream
+        // users of the API still use the old approach.
+        WebGraphicsContext3D* context = m_client->createContext3D();
+        if (!context)
+            return nullptr;
+
+        m_usingRealOutputSurface = false;
+        return adoptPtr(new WebGraphicsContextToOutputSurfaceAdapter(adoptPtr(context)));
+    }
+
+    virtual void didRecreateOutputSurface(bool success) OVERRIDE
     {
-        return adoptPtr(m_client->createContext3D());
+        if (m_usingRealOutputSurface) {
+            m_client->didRecreateOutputSurface(success);
+            return;
+        }
+        m_client->didRebindGraphicsContext(success);
     }
-    virtual void didRecreateContext(bool success) OVERRIDE { m_client->didRebindGraphicsContext(success); }
     virtual void willCommit() OVERRIDE { m_client->willCommit(); }
     virtual void didCommit() OVERRIDE { m_client->didCommit(); }
     virtual void didCommitAndDrawFrame() OVERRIDE { m_client->didCommitAndDrawFrame(); }
@@ -67,6 +134,7 @@ public:
 
 private:
     WebLayerTreeViewClient* m_client;
+    bool m_usingRealOutputSurface;
 };
 
 PassOwnPtr<WebLayerTreeViewImpl> WebLayerTreeViewImpl::create(WebLayerTreeViewClient* client, const WebLayer& root, const WebLayerTreeView::Settings& settings)
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
index 1184342e8..3bc43410d 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.h
@@ -26,7 +26,7 @@
 #ifndef WebLayerTreeViewImpl_h
 #define WebLayerTreeViewImpl_h
 
-#include "platform/WebLayerTreeView.h"
+#include <public/WebLayerTreeView.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index 3ca9f5d0f..c48aa8967 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -23,18 +23,16 @@
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
 #include "WebHelperPluginImpl.h"
-#include "WebKit.h"
 #include "WebMediaPlayer.h"
 #include "WebViewImpl.h"
-#include "cc/CCProxy.h"
-#include "platform/WebCString.h"
-#include "platform/WebCanvas.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
-#include "platform/WebString.h"
-#include "platform/WebURL.h"
+#include <public/Platform.h>
+#include <public/WebCString.h>
+#include <public/WebCanvas.h>
 #include <public/WebMimeRegistry.h>
+#include <public/WebRect.h>
+#include <public/WebSize.h>
+#include <public/WebString.h>
+#include <public/WebURL.h>
 
 #if USE(ACCELERATED_COMPOSITING)
 #include "RenderLayerCompositor.h"
@@ -342,10 +340,10 @@ void WebMediaPlayerClientImpl::cancelLoad()
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-LayerChromium* WebMediaPlayerClientImpl::platformLayer() const
+WebLayer* WebMediaPlayerClientImpl::platformLayer() const
 {
     ASSERT(m_supportsAcceleratedCompositing);
-    return m_videoLayer.unwrap<LayerChromium>();
+    return const_cast<WebVideoLayer*>(&m_videoLayer);
 }
 #endif
 
@@ -841,14 +839,12 @@ void WebMediaPlayerClientImpl::startDelayedLoad()
 void WebMediaPlayerClientImpl::didReceiveFrame()
 {
     // No lock since this gets called on the client's thread.
-    ASSERT(CCProxy::isImplThread());
     m_videoFrameProviderClient->didReceiveFrame();
 }
 
 void WebMediaPlayerClientImpl::didUpdateMatrix(const float* matrix)
 {
     // No lock since this gets called on the client's thread.
-    ASSERT(CCProxy::isImplThread());
     m_videoFrameProviderClient->didUpdateMatrix(matrix);
 }
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index b3c94fe58..2df54cd20 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -98,7 +98,7 @@ public:
     virtual void load(const WTF::String& url);
     virtual void cancelLoad();
 #if USE(ACCELERATED_COMPOSITING)
-    virtual WebCore::PlatformLayer* platformLayer() const;
+    virtual WebKit::WebLayer* platformLayer() const;
 #endif
     virtual WebCore::PlatformMedia platformMedia() const;
     virtual void play();
diff --git a/Source/WebKit/chromium/src/WebNode.cpp b/Source/WebKit/chromium/src/WebNode.cpp
index 14da1d570..c5e836d4a 100644
--- a/Source/WebKit/chromium/src/WebNode.cpp
+++ b/Source/WebKit/chromium/src/WebNode.cpp
@@ -136,6 +136,13 @@ WebNodeList WebNode::childNodes()
     return WebNodeList(m_private->childNodes());
 }
 
+bool WebNode::appendChild(const WebNode& child) 
+{
+    ExceptionCode exceptionCode = 0;
+    m_private->appendChild(child, exceptionCode);
+    return !exceptionCode;
+}
+
 WebString WebNode::createMarkup() const
 {
     return WebCore::createMarkup(m_private.get());
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
index fd5d2f2ad..18f5de20a 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
@@ -78,11 +78,7 @@ private:
 
     virtual void setWindowRect(const FloatRect& rect) OVERRIDE
     {
-        IntRect intRect(rect);
-        const WebRect currentRect = m_popup->m_windowRectInScreen;
-        if (intRect.x() == currentRect.x && intRect.y() == currentRect.y && m_popup->m_isPutAboveOrigin)
-            intRect.setY(currentRect.y + currentRect.height - intRect.height());
-        m_popup->m_windowRectInScreen = intRect;
+        m_popup->m_windowRectInScreen = IntRect(rect);
         m_popup->widgetClient()->setWindowRect(m_popup->m_windowRectInScreen);
     }
 
@@ -123,6 +119,11 @@ private:
         return m_popup->m_webView;
     }
 
+    virtual FloatSize minimumWindowSize() const OVERRIDE
+    {
+        return FloatSize(0, 0);
+    }
+
     WebPagePopupImpl* m_popup;
 };
 
@@ -141,7 +142,6 @@ bool PagePopupFeaturesClient::isEnabled(Document*, ContextFeatures::FeatureType
 
 WebPagePopupImpl::WebPagePopupImpl(WebWidgetClient* client)
     : m_widgetClient(client)
-    , m_isPutAboveOrigin(false)
 {
     ASSERT(client);
 }
@@ -157,24 +157,13 @@ bool WebPagePopupImpl::init(WebViewImpl* webView, PagePopupClient* popupClient,
     ASSERT(popupClient);
     m_webView = webView;
     m_popupClient = popupClient;
+    m_originBoundsInRootView = originBoundsInRootView;
 
-    WebSize rootViewSize = webView->size();
-    IntSize popupSize = popupClient->contentSize();
-    IntRect popupBoundsInRootView(IntPoint(max(0, originBoundsInRootView.x()), max(0, originBoundsInRootView.maxY())), popupSize);
-    if (popupBoundsInRootView.maxY() > rootViewSize.height) {
-        popupBoundsInRootView.setY(max(0, originBoundsInRootView.y() - popupSize.height()));
-        m_isPutAboveOrigin = true;
-    }
-    if (popupBoundsInRootView.maxX() > rootViewSize.width)
-        popupBoundsInRootView.setX(max(0, rootViewSize.width - popupSize.width()));
-    IntRect boundsInScreen = webView->page()->chrome()->rootViewToScreen(popupBoundsInRootView);
+    reposition(m_popupClient->contentSize());
 
-    m_widgetClient->setWindowRect(boundsInScreen);
-    m_windowRectInScreen = boundsInScreen;
     if (!initPage())
         return false;
     m_widgetClient->show(WebNavigationPolicy());
-
     setFocus(true);
 
     return true;
@@ -242,8 +231,23 @@ void WebPagePopupImpl::paint(WebCanvas* canvas, const WebRect& rect)
     PageWidgetDelegate::paint(m_page.get(), 0, canvas, rect, PageWidgetDelegate::Opaque);
 }
 
+void WebPagePopupImpl::reposition(const WebSize& popupSize)
+{
+    WebSize rootViewSize = m_webView->size();
+    IntRect popupBoundsInRootView(IntPoint(max(0, m_originBoundsInRootView.x()), max(0, m_originBoundsInRootView.maxY())), popupSize);
+    if (popupBoundsInRootView.maxY() > rootViewSize.height)
+        popupBoundsInRootView.setY(max(0, m_originBoundsInRootView.y() - popupSize.height));
+    if (popupBoundsInRootView.maxX() > rootViewSize.width)
+        popupBoundsInRootView.setX(max(0, rootViewSize.width - popupSize.width));
+    IntRect boundsInScreen = m_webView->page()->chrome()->rootViewToScreen(popupBoundsInRootView);
+    m_widgetClient->setWindowRect(boundsInScreen);
+    m_windowRectInScreen = boundsInScreen;
+}
+
 void WebPagePopupImpl::resize(const WebSize& newSize)
 {
+    reposition(newSize);
+
     if (m_page)
         m_page->mainFrame()->view()->resize(newSize);
     m_widgetClient->didInvalidateRect(WebRect(0, 0, newSize.width, newSize.height));
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.h b/Source/WebKit/chromium/src/WebPagePopupImpl.h
index 2552bacf1..76936a4cd 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.h
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.h
@@ -87,14 +87,15 @@ private:
 
     explicit WebPagePopupImpl(WebWidgetClient*);
     bool initPage();
+    void reposition(const WebSize&);
 
     WebWidgetClient* m_widgetClient;
     WebRect m_windowRectInScreen;
+    WebCore::IntRect m_originBoundsInRootView;
     WebViewImpl* m_webView;
     OwnPtr<WebCore::Page> m_page;
     OwnPtr<PagePopupChromeClient> m_chromeClient;
     WebCore::PagePopupClient* m_popupClient;
-    bool m_isPutAboveOrigin;
 
     friend class WebPagePopup;
     friend class PagePopupChromeClient;
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 29489e25a..71361780b 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -39,14 +39,7 @@
 #include "WebElement.h"
 #include "WebInputEvent.h"
 #include "WebInputEventConversion.h"
-#include "WebKit.h"
 #include "WebPlugin.h"
-#include "platform/WebRect.h"
-#include "platform/WebString.h"
-#include "platform/WebURL.h"
-#include "platform/WebURLError.h"
-#include "platform/WebURLRequest.h"
-#include "platform/WebVector.h"
 #include "WebViewImpl.h"
 #include "WrappedResourceResponse.h"
 
@@ -56,6 +49,7 @@
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameView.h"
+#include "GestureEvent.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "HostWindow.h"
@@ -77,6 +71,12 @@
 #include "WheelEvent.h"
 #include <public/Platform.h>
 #include <public/WebClipboard.h>
+#include <public/WebRect.h>
+#include <public/WebString.h>
+#include <public/WebURL.h>
+#include <public/WebURLError.h>
+#include <public/WebURLRequest.h>
+#include <public/WebVector.h>
 
 #if ENABLE(GESTURE_EVENTS)
 #include "PlatformGestureEvent.h"
@@ -188,6 +188,8 @@ void WebPluginContainerImpl::handleEvent(Event* event)
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
     else if (eventNames().isTouchEventType(event->type()))
         handleTouchEvent(static_cast<TouchEvent*>(event));
+    else if (eventNames().isGestureEventType(event->type()))
+        handleGestureEvent(static_cast<GestureEvent*>(event));
 
     // FIXME: it would be cleaner if Widget::handleEvent returned true/false and
     // HTMLPluginElement called setDefaultHandled or defaultEventHandler.
@@ -557,6 +559,11 @@ bool WebPluginContainerImpl::getFormValue(String& value)
     return false;
 }
 
+bool WebPluginContainerImpl::supportsKeyboardFocus() const
+{
+    return m_webPlugin->supportsKeyboardFocus();
+}
+
 void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver* observer)
 {
     size_t pos = m_pluginLoadObservers.find(observer);
@@ -566,12 +573,12 @@ void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-WebCore::LayerChromium* WebPluginContainerImpl::platformLayer() const
+WebLayer* WebPluginContainerImpl::platformLayer() const
 {
     if (m_textureId)
-        return m_textureLayer.unwrap<LayerChromium>();
+        return const_cast<WebExternalTextureLayer*>(&m_textureLayer);
     if (m_ioSurfaceId)
-        return m_ioSurfaceLayer.unwrap<LayerChromium>();
+        return const_cast<WebIOSurfaceLayer*>(&m_ioSurfaceLayer);
     return 0;
 }
 #endif
@@ -736,6 +743,17 @@ void WebPluginContainerImpl::handleTouchEvent(TouchEvent* event)
     // FIXME: Can a plugin change the cursor from a touch-event callback?
 }
 
+void WebPluginContainerImpl::handleGestureEvent(GestureEvent* event)
+{
+    WebGestureEventBuilder webEvent(this, *event);
+    if (webEvent.type == WebInputEvent::Undefined)
+        return;
+    WebCursorInfo cursorInfo;
+    if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
+        event->setDefaultHandled();
+    // FIXME: Can a plugin change the cursor from a touch-event callback?
+}
+
 void WebPluginContainerImpl::calculateGeometry(const IntRect& frameRect,
                                                IntRect& windowRect,
                                                IntRect& clipRect,
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 4c2aaeb4a..074a0ccdc 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -45,10 +45,10 @@
 struct NPObject;
 
 namespace WebCore {
+class GestureEvent;
 class HTMLPlugInElement;
 class IntRect;
 class KeyboardEvent;
-class LayerChromium;
 class MouseEvent;
 class ResourceError;
 class ResourceResponse;
@@ -77,6 +77,7 @@ public:
 
     // PluginViewBase methods
     virtual bool getFormValue(String&);
+    virtual bool supportsKeyboardFocus() const;
 
     // Widget methods
     virtual void setFrameRect(const WebCore::IntRect&);
@@ -149,7 +150,7 @@ public:
     void willDestroyPluginLoadObserver(WebPluginLoadObserver*);
 
 #if USE(ACCELERATED_COMPOSITING)
-    virtual WebCore::LayerChromium* platformLayer() const;
+    virtual WebLayer* platformLayer() const;
 #endif
 
     ScrollbarGroup* scrollbarGroup();
@@ -167,6 +168,7 @@ private:
     void handleWheelEvent(WebCore::WheelEvent*);
     void handleKeyboardEvent(WebCore::KeyboardEvent*);
     void handleTouchEvent(WebCore::TouchEvent*);
+    void handleGestureEvent(WebCore::GestureEvent*);
 
     void calculateGeometry(const WebCore::IntRect& frameRect,
                            WebCore::IntRect& windowRect,
diff --git a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
index b0f63a7e4..f34dbfdc7 100644
--- a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
@@ -69,8 +69,8 @@ WebPluginScrollbarImpl::WebPluginScrollbarImpl(Orientation orientation,
 {
     m_scrollbar = Scrollbar::createNativeScrollbar(
         static_cast<ScrollableArea*>(m_group),
-        static_cast<ScrollbarOrientation>(orientation),
-        RegularScrollbar);
+        static_cast<WebCore::ScrollbarOrientation>(orientation),
+        WebCore::RegularScrollbar);
     m_group->scrollbarCreated(this);
 }
 
@@ -123,6 +123,78 @@ int WebPluginScrollbarImpl::value() const
     return m_scrollOffset;
 }
 
+WebPoint WebPluginScrollbarImpl::location() const
+{
+    return m_scrollbar->frameRect().location();
+}
+
+WebSize WebPluginScrollbarImpl::size() const
+{
+    return m_scrollbar->frameRect().size();
+}
+
+bool WebPluginScrollbarImpl::enabled() const
+{
+    return m_scrollbar->enabled();
+}
+
+int WebPluginScrollbarImpl::maximum() const
+{
+    return m_scrollbar->maximum();
+}
+
+int WebPluginScrollbarImpl::totalSize() const
+{
+    return m_scrollbar->totalSize();
+}
+
+bool WebPluginScrollbarImpl::isScrollViewScrollbar() const
+{
+    return m_scrollbar->isScrollViewScrollbar();
+}
+
+bool WebPluginScrollbarImpl::isScrollableAreaActive() const
+{
+    return m_scrollbar->isScrollableAreaActive();
+}
+
+void WebPluginScrollbarImpl::getTickmarks(WebVector<WebRect>& tickmarks) const
+{
+    m_client->getTickmarks(const_cast<WebPluginScrollbarImpl*>(this), &tickmarks);
+}
+
+WebScrollbar::ScrollbarControlSize WebPluginScrollbarImpl::controlSize() const
+{
+    return static_cast<WebScrollbar::ScrollbarControlSize>(m_scrollbar->controlSize());
+}
+
+WebScrollbar::ScrollbarPart WebPluginScrollbarImpl::pressedPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->pressedPart());
+}
+
+WebScrollbar::ScrollbarPart WebPluginScrollbarImpl::hoveredPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->hoveredPart());
+}
+
+WebScrollbar::ScrollbarOverlayStyle WebPluginScrollbarImpl::scrollbarOverlayStyle() const
+{
+    return static_cast<WebScrollbar::ScrollbarOverlayStyle>(m_scrollbar->scrollbarOverlayStyle());
+}
+
+WebScrollbar::Orientation WebPluginScrollbarImpl::orientation() const
+{
+    if (m_scrollbar->orientation() == WebCore::HorizontalScrollbar)
+        return WebScrollbar::Horizontal;
+    return WebScrollbar::Vertical;
+}
+
+bool WebPluginScrollbarImpl::isCustomScrollbar() const
+{
+    return m_scrollbar->isCustomScrollbar();
+}
+
 void WebPluginScrollbarImpl::setLocation(const WebRect& rect)
 {
     IntRect oldRect = m_scrollbar->frameRect();
@@ -211,7 +283,7 @@ bool WebPluginScrollbarImpl::onMouseDown(const WebInputEvent& event)
 bool WebPluginScrollbarImpl::onMouseUp(const WebInputEvent& event)
 {
     WebMouseEvent mouseup = *static_cast<const WebMouseEvent*>(&event);
-    if (m_scrollbar->pressedPart() == NoPart)
+    if (m_scrollbar->pressedPart() == WebCore::NoPart)
         return false;
 
     return m_scrollbar->mouseUp(PlatformMouseEventBuilder(m_scrollbar.get(), mouseup));
@@ -221,20 +293,20 @@ bool WebPluginScrollbarImpl::onMouseMove(const WebInputEvent& event)
 {
     WebMouseEvent mousemove = *static_cast<const WebMouseEvent*>(&event);
     if (m_scrollbar->frameRect().contains(mousemove.x, mousemove.y)
-        || m_scrollbar->pressedPart() != NoPart) {
+        || m_scrollbar->pressedPart() != WebCore::NoPart) {
         mousemove.x -= m_scrollbar->x();
         mousemove.y -= m_scrollbar->y();
         return m_scrollbar->mouseMoved(PlatformMouseEventBuilder(m_scrollbar.get(), mousemove));
     }
 
-    if (m_scrollbar->hoveredPart() != NoPart && !m_scrollbar->isOverlayScrollbar())
+    if (m_scrollbar->hoveredPart() != WebCore::NoPart && !m_scrollbar->isOverlayScrollbar())
         m_scrollbar->mouseExited();
     return false;
 }
 
 bool WebPluginScrollbarImpl::onMouseLeave(const WebInputEvent& event)
 {
-    if (m_scrollbar->hoveredPart() != NoPart)
+    if (m_scrollbar->hoveredPart() != WebCore::NoPart)
         m_scrollbar->mouseExited();
 
     return false;
diff --git a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
index b42cb82fd..43e3fd7b2 100644
--- a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
@@ -49,6 +49,7 @@ public:
 
     void setScrollOffset(int);
     void invalidateScrollbarRect(const WebCore::IntRect&);
+    // FIXME: Combine this with the other getTickmarks method
     void getTickmarks(Vector<WebCore::IntRect>&) const;
     WebCore::IntPoint convertFromContainingViewToScrollbar(const WebCore::IntPoint& parentPoint) const;
     void scrollbarStyleChanged();
@@ -57,16 +58,30 @@ public:
     WebCore::Scrollbar* scrollbar() { return m_scrollbar.get(); }
 
     // WebKit::WebScrollbar methods
-    virtual bool isOverlay() const;
-    virtual int value() const;
+    virtual bool isOverlay() const OVERRIDE;
+    virtual int value() const OVERRIDE;
+    virtual WebPoint location() const OVERRIDE;
+    virtual WebSize size() const OVERRIDE;
+    virtual bool enabled() const OVERRIDE;
+    virtual int maximum() const OVERRIDE;
+    virtual int totalSize() const OVERRIDE;
+    virtual bool isScrollViewScrollbar() const OVERRIDE;
+    virtual bool isScrollableAreaActive() const OVERRIDE;
+    virtual void getTickmarks(WebVector<WebRect>& tickmarks) const OVERRIDE;
+    virtual WebScrollbar::ScrollbarControlSize controlSize() const OVERRIDE;
+    virtual WebScrollbar::ScrollbarPart pressedPart() const OVERRIDE;
+    virtual WebScrollbar::ScrollbarPart hoveredPart() const OVERRIDE;
+    virtual WebScrollbar::ScrollbarOverlayStyle scrollbarOverlayStyle() const OVERRIDE;
+    virtual WebScrollbar::Orientation orientation() const OVERRIDE;
+    virtual bool isCustomScrollbar() const OVERRIDE;
 
     // WebKit::WebPluginScrollbar methods
-    virtual void setLocation(const WebRect&);
-    virtual void setValue(int position);
-    virtual void setDocumentSize(int);
-    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier);
-    virtual void paint(WebCanvas*, const WebRect&);
-    virtual bool handleInputEvent(const WebInputEvent&);
+    virtual void setLocation(const WebRect&) OVERRIDE;
+    virtual void setValue(int position) OVERRIDE;
+    virtual void setDocumentSize(int) OVERRIDE;
+    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier) OVERRIDE;
+    virtual void paint(WebCanvas*, const WebRect&) OVERRIDE;
+    virtual bool handleInputEvent(const WebInputEvent&) OVERRIDE;
 
 private:
     bool onMouseDown(const WebInputEvent&);
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index ec08f0a0e..8bc880c75 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -639,5 +639,14 @@ bool WebRuntimeFeatures::isDialogElementEnabled()
 #endif
 }
 
+void WebRuntimeFeatures::enableCSSExclusions(bool enable)
+{
+    RuntimeEnabledFeatures::setCSSExclusionsEnabled(enable);
+}
+
+bool WebRuntimeFeatures::isCSSExclusionsEnabled()
+{
+    return RuntimeEnabledFeatures::cssExclusionsEnabled();
+}
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScriptController.cpp b/Source/WebKit/chromium/src/WebScriptController.cpp
index 5d36bbe0d..804e27821 100644
--- a/Source/WebKit/chromium/src/WebScriptController.cpp
+++ b/Source/WebKit/chromium/src/WebScriptController.cpp
@@ -43,7 +43,7 @@ namespace WebKit {
 
 void WebScriptController::registerExtension(v8::Extension* extension)
 {
-    V8Proxy::registerExtension(extension);
+    V8Proxy::registerExtensionIfNeeded(extension);
 }
 
 void WebScriptController::enableV8SingleThreadMode()
diff --git a/Source/WebKit/chromium/src/WebScrollableLayer.cpp b/Source/WebKit/chromium/src/WebScrollableLayer.cpp
index 19e410aa5..a20e81d81 100644
--- a/Source/WebKit/chromium/src/WebScrollableLayer.cpp
+++ b/Source/WebKit/chromium/src/WebScrollableLayer.cpp
@@ -27,7 +27,7 @@
 #include <public/WebScrollableLayer.h>
 
 #include "LayerChromium.h"
-
+#include "Region.h"
 
 namespace WebKit {
 
@@ -51,4 +51,25 @@ void WebScrollableLayer::setShouldScrollOnMainThread(bool shouldScrollOnMainThre
     m_private->setShouldScrollOnMainThread(shouldScrollOnMainThread);
 }
 
+void WebScrollableLayer::setNonFastScrollableRegion(const WebVector<WebRect>& rects)
+{
+    WebCore::Region region;
+    for (size_t i = 0; i < rects.size(); ++i) {
+        WebCore::IntRect rect = rects[i];
+        region.unite(rect);
+    }
+    m_private->setNonFastScrollableRegion(region);
+
+}
+
+void WebScrollableLayer::setIsContainerForFixedPositionLayers(bool enable)
+{
+    m_private->setIsContainerForFixedPositionLayers(enable);
+}
+
+void WebScrollableLayer::setFixedToContainerLayer(bool enable)
+{
+    m_private->setFixedToContainerLayer(enable);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
new file mode 100644
index 000000000..73b92697e
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebScrollbarImpl.h"
+
+#include "IntRect.h"
+#include "Scrollbar.h"
+
+namespace WebKit {
+
+PassOwnPtr<WebScrollbar> WebScrollbar::create(WebCore::Scrollbar* scrollbar)
+{
+    return adoptPtr(new WebScrollbarImpl(scrollbar));
+}
+
+WebScrollbarImpl::WebScrollbarImpl(WebCore::Scrollbar* scrollbar)
+    : m_scrollbar(scrollbar)
+{
+}
+
+bool WebScrollbarImpl::isOverlay() const
+{
+    return m_scrollbar->isOverlayScrollbar();
+}
+
+int WebScrollbarImpl::value() const
+{
+    return m_scrollbar->value();
+}
+
+WebPoint WebScrollbarImpl::location() const
+{
+    return m_scrollbar->location();
+}
+
+WebSize WebScrollbarImpl::size() const
+{
+    return m_scrollbar->size();
+}
+
+bool WebScrollbarImpl::enabled() const
+{
+    return m_scrollbar->enabled();
+}
+
+int WebScrollbarImpl::maximum() const
+{
+    return m_scrollbar->maximum();
+}
+
+int WebScrollbarImpl::totalSize() const
+{
+    return m_scrollbar->totalSize();
+}
+
+bool WebScrollbarImpl::isScrollViewScrollbar() const
+{
+    return m_scrollbar->isScrollViewScrollbar();
+}
+
+bool WebScrollbarImpl::isScrollableAreaActive() const
+{
+    return m_scrollbar->isScrollableAreaActive();
+}
+
+void WebScrollbarImpl::getTickmarks(WebVector<WebRect>& webTickmarks) const
+{
+    Vector<WebCore::IntRect> tickmarks;
+    m_scrollbar->getTickmarks(tickmarks);
+
+    WebVector<WebRect> result(tickmarks.size());
+    for (size_t i = 0; i < tickmarks.size(); ++i)
+        result[i] = tickmarks[i];
+
+    webTickmarks.swap(result);
+}
+
+WebScrollbar::ScrollbarControlSize WebScrollbarImpl::controlSize() const
+{
+    return static_cast<WebScrollbar::ScrollbarControlSize>(m_scrollbar->controlSize());
+}
+
+WebScrollbar::ScrollbarPart WebScrollbarImpl::pressedPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->pressedPart());
+}
+
+WebScrollbar::ScrollbarPart WebScrollbarImpl::hoveredPart() const
+{
+    return static_cast<WebScrollbar::ScrollbarPart>(m_scrollbar->hoveredPart());
+}
+
+WebScrollbar::ScrollbarOverlayStyle WebScrollbarImpl::scrollbarOverlayStyle() const
+{
+    return static_cast<WebScrollbar::ScrollbarOverlayStyle>(m_scrollbar->scrollbarOverlayStyle());
+}
+
+WebScrollbar::Orientation WebScrollbarImpl::orientation() const
+{
+    return static_cast<WebScrollbar::Orientation>(m_scrollbar->orientation());
+}
+
+bool WebScrollbarImpl::isCustomScrollbar() const
+{
+    return m_scrollbar->isCustomScrollbar();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/CCThreadImpl.h b/Source/WebKit/chromium/src/WebScrollbarImpl.h
index 9b9900602..5c9231aaa 100644
--- a/Source/WebKit/chromium/src/CCThreadImpl.h
+++ b/Source/WebKit/chromium/src/WebScrollbarImpl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,32 +22,41 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "cc/CCThread.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/Threading.h>
+#ifndef WebScrollbarImpl_h
+#define WebScrollbarImpl_h
 
+#include <public/WebScrollbar.h>
 
-#ifndef CCThreadImpl_h
-#define CCThreadImpl_h
+namespace WebCore {
+class Scrollbar;
+}
 
 namespace WebKit {
 
-class WebThread;
-
-// Implements CCThread in terms of WebThread.
-class CCThreadImpl : public WebCore::CCThread {
+class WebScrollbarImpl : public WebScrollbar {
 public:
-    static PassOwnPtr<WebCore::CCThread> create(WebThread*);
-    virtual ~CCThreadImpl();
-    virtual void postTask(PassOwnPtr<WebCore::CCThread::Task>);
-    virtual void postDelayedTask(PassOwnPtr<WebCore::CCThread::Task>, long long delayMs);
-    WTF::ThreadIdentifier threadID() const;
+    WebScrollbarImpl(WebCore::Scrollbar*);
 
-private:
-    explicit CCThreadImpl(WebThread*);
+    // Implement WebKit::WebScrollbar methods
+    virtual bool isOverlay() const OVERRIDE;
+    virtual int value() const OVERRIDE;
+    virtual WebPoint location() const OVERRIDE;
+    virtual WebSize size() const OVERRIDE;
+    virtual bool enabled() const OVERRIDE;
+    virtual int maximum() const OVERRIDE;
+    virtual int totalSize() const OVERRIDE;
+    virtual bool isScrollViewScrollbar() const OVERRIDE;
+    virtual bool isScrollableAreaActive() const OVERRIDE;
+    virtual void getTickmarks(WebVector<WebRect>& tickmarks) const OVERRIDE;
+    virtual ScrollbarControlSize controlSize() const OVERRIDE;
+    virtual ScrollbarPart pressedPart() const OVERRIDE;
+    virtual ScrollbarPart hoveredPart() const OVERRIDE;
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const OVERRIDE;
+    virtual Orientation orientation() const OVERRIDE;
+    virtual bool isCustomScrollbar() const OVERRIDE;
 
-    WebThread* m_thread;
-    WTF::ThreadIdentifier m_threadID;
+private:
+    RefPtr<WebCore::Scrollbar> m_scrollbar;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/ColorChooserProxy.cpp b/Source/WebKit/chromium/src/WebScrollbarLayer.cpp
index 6cf72d524..2bd1b20fb 100644
--- a/Source/WebKit/chromium/src/ColorChooserProxy.cpp
+++ b/Source/WebKit/chromium/src/WebScrollbarLayer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,39 +24,39 @@
  */
 
 #include "config.h"
-#include "ColorChooserProxy.h"
+#include <public/WebScrollbarLayer.h>
 
-#include "Color.h"
-#include "WebColorChooser.h"
-#include "platform/WebColor.h"
+#include "ScrollbarLayerChromium.h"
 
-#if ENABLE(INPUT_TYPE_COLOR)
+using namespace WebCore;
 
 namespace WebKit {
 
-ColorChooserProxy::ColorChooserProxy(PassOwnPtr<WebColorChooser> chooser) : m_chooser(chooser)
+void WebScrollbarLayer::setScrollLayer(const WebLayer layer)
 {
+    int id = layer.isNull() ? 0 : layer.constUnwrap<LayerChromium>()->id();
+    unwrap<ScrollbarLayerChromium>()->setScrollLayerId(id);
 }
 
-ColorChooserProxy::~ColorChooserProxy()
+WebScrollbarLayer WebScrollbarLayer::create(WebCore::Scrollbar* scrollbar, WebScrollbarThemePainter painter, PassOwnPtr<WebScrollbarThemeGeometry> geometry)
 {
+    return WebScrollbarLayer(ScrollbarLayerChromium::create(WebScrollbar::create(scrollbar), painter, geometry, 0));
 }
 
-void ColorChooserProxy::setSelectedColor(const WebCore::Color& color)
+WebScrollbarLayer::WebScrollbarLayer(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>& layer)
+    : WebLayer(layer)
 {
-    if (!m_chooser)
-        return;
-    WebColor webColor = static_cast<WebColor>(color.rgb());
-    m_chooser->setSelectedColor(webColor);
 }
 
-void ColorChooserProxy::endChooser()
+WebScrollbarLayer& WebScrollbarLayer::operator=(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>& layer)
 {
-    if (!m_chooser)
-        return;
-    m_chooser->endChooser();
+    m_private = layer;
+    return *this;
 }
 
+WebScrollbarLayer::operator PassRefPtr<ScrollbarLayerChromium>() const
+{
+    return unwrap<ScrollbarLayerChromium>();
 }
 
-#endif // ENABLE(INPUT_TYPE_COLOR)
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.cpp b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.cpp
new file mode 100644
index 000000000..68c9458d0
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.cpp
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebScrollbarThemeClientImpl.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebScrollbarThemeClientImpl::WebScrollbarThemeClientImpl(WebScrollbar* scrollbar)
+    : m_scrollbar(scrollbar)
+{
+}
+
+int WebScrollbarThemeClientImpl::x() const
+{
+    return location().x();
+}
+
+int WebScrollbarThemeClientImpl::y() const
+{
+    return location().y();
+}
+
+int WebScrollbarThemeClientImpl::width() const
+{
+    return size().width();
+}
+
+int WebScrollbarThemeClientImpl::height() const
+{
+    return size().height();
+}
+
+IntSize WebScrollbarThemeClientImpl::size() const
+{
+    return m_scrollbar->size();
+}
+
+IntPoint WebScrollbarThemeClientImpl::location() const
+{
+    return m_scrollbar->location();
+}
+
+ScrollView* WebScrollbarThemeClientImpl::parent() const
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+ScrollView* WebScrollbarThemeClientImpl::root() const
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void WebScrollbarThemeClientImpl::setFrameRect(const IntRect&)
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+}
+
+IntRect WebScrollbarThemeClientImpl::frameRect() const
+{
+    return IntRect(location(), size());
+}
+
+void WebScrollbarThemeClientImpl::invalidate()
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+}
+
+void WebScrollbarThemeClientImpl::invalidateRect(const IntRect&)
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+}
+
+WebCore::ScrollbarOverlayStyle WebScrollbarThemeClientImpl::scrollbarOverlayStyle() const
+{
+    return static_cast<WebCore::ScrollbarOverlayStyle>(m_scrollbar->scrollbarOverlayStyle());
+}
+
+void WebScrollbarThemeClientImpl::getTickmarks(Vector<IntRect>& tickmarks) const
+{
+    WebVector<WebRect> webTickmarks;
+    m_scrollbar->getTickmarks(webTickmarks);
+    tickmarks.resize(webTickmarks.size());
+    for (size_t i = 0; i < webTickmarks.size(); ++i)
+        tickmarks[i] = webTickmarks[i];
+}
+
+bool WebScrollbarThemeClientImpl::isScrollableAreaActive() const
+{
+    return m_scrollbar->isScrollableAreaActive();
+}
+
+bool WebScrollbarThemeClientImpl::isScrollViewScrollbar() const
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+IntPoint WebScrollbarThemeClientImpl::convertFromContainingWindow(const IntPoint& windowPoint)
+{
+    // Unused by Chromium scrollbar themes.
+    ASSERT_NOT_REACHED();
+    return windowPoint;
+}
+
+bool WebScrollbarThemeClientImpl::isCustomScrollbar() const
+{
+    return m_scrollbar->isCustomScrollbar();
+}
+
+WebCore::ScrollbarOrientation WebScrollbarThemeClientImpl::orientation() const
+{
+    return static_cast<WebCore::ScrollbarOrientation>(m_scrollbar->orientation());
+}
+
+int WebScrollbarThemeClientImpl::value() const
+{
+    return m_scrollbar->value();
+}
+
+float WebScrollbarThemeClientImpl::currentPos() const
+{
+    return value();
+}
+
+int WebScrollbarThemeClientImpl::visibleSize() const
+{
+    return totalSize() - maximum();
+}
+
+int WebScrollbarThemeClientImpl::totalSize() const
+{
+    return m_scrollbar->totalSize();
+}
+
+int WebScrollbarThemeClientImpl::maximum() const
+{
+    return m_scrollbar->maximum();
+}
+
+WebCore::ScrollbarControlSize WebScrollbarThemeClientImpl::controlSize() const
+{
+    return static_cast<WebCore::ScrollbarControlSize>(m_scrollbar->controlSize());
+}
+
+int WebScrollbarThemeClientImpl::lineStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+int WebScrollbarThemeClientImpl::pageStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+WebCore::ScrollbarPart WebScrollbarThemeClientImpl::pressedPart() const
+{
+    return static_cast<WebCore::ScrollbarPart>(m_scrollbar->pressedPart());
+}
+
+WebCore::ScrollbarPart WebScrollbarThemeClientImpl::hoveredPart() const
+{
+    return static_cast<WebCore::ScrollbarPart>(m_scrollbar->hoveredPart());
+}
+
+void WebScrollbarThemeClientImpl::styleChanged()
+{
+    ASSERT_NOT_REACHED();
+}
+
+bool WebScrollbarThemeClientImpl::enabled() const
+{
+    return m_scrollbar->enabled();
+}
+
+void WebScrollbarThemeClientImpl::setEnabled(bool)
+{
+    ASSERT_NOT_REACHED();
+}
+
+bool WebScrollbarThemeClientImpl::isOverlayScrollbar() const
+{
+    return m_scrollbar->isOverlay();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.h b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.h
new file mode 100644
index 000000000..b3a6ac956
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarThemeClientImpl.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScrollbarThemeClientImpl_h
+#define WebScrollbarThemeClientImpl_h
+
+#include "ScrollbarThemeClient.h"
+#include <public/WebScrollbar.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+class ScrollView;
+}
+
+namespace WebKit {
+
+// Adapts a WebScrollbar to the ScrollbarThemeClient interface
+class WebScrollbarThemeClientImpl : public WebCore::ScrollbarThemeClient {
+    WTF_MAKE_NONCOPYABLE(WebScrollbarThemeClientImpl);
+public:
+    // Caller must retain ownership of this pointer and ensure that its lifetime
+    // exceeds this instance.
+    WebScrollbarThemeClientImpl(WebScrollbar*);
+
+    // Implement WebCore::ScrollbarThemeClient interface
+    virtual int x() const OVERRIDE;
+    virtual int y() const OVERRIDE;
+    virtual int width() const OVERRIDE;
+    virtual int height() const OVERRIDE;
+    virtual WebCore::IntSize size() const OVERRIDE;
+    virtual WebCore::IntPoint location() const OVERRIDE;
+    virtual WebCore::ScrollView* parent() const OVERRIDE;
+    virtual WebCore::ScrollView* root() const OVERRIDE;
+    virtual void setFrameRect(const WebCore::IntRect&) OVERRIDE;
+    virtual WebCore::IntRect frameRect() const OVERRIDE;
+    virtual void invalidate() OVERRIDE;
+    virtual void invalidateRect(const WebCore::IntRect&) OVERRIDE;
+    virtual WebCore::ScrollbarOverlayStyle scrollbarOverlayStyle() const OVERRIDE;
+    virtual void getTickmarks(Vector<WebCore::IntRect>&) const OVERRIDE;
+    virtual bool isScrollableAreaActive() const OVERRIDE;
+    virtual bool isScrollViewScrollbar() const OVERRIDE;
+    virtual WebCore::IntPoint convertFromContainingWindow(const WebCore::IntPoint&) OVERRIDE;
+    virtual bool isCustomScrollbar() const OVERRIDE;
+    virtual WebCore::ScrollbarOrientation orientation() const OVERRIDE;
+    virtual int value() const OVERRIDE;
+    virtual float currentPos() const OVERRIDE;
+    virtual int visibleSize() const OVERRIDE;
+    virtual int totalSize() const OVERRIDE;
+    virtual int maximum() const OVERRIDE;
+    virtual WebCore::ScrollbarControlSize controlSize() const OVERRIDE;
+    virtual int lineStep() const OVERRIDE;
+    virtual int pageStep() const OVERRIDE;
+    virtual WebCore::ScrollbarPart pressedPart() const OVERRIDE;
+    virtual WebCore::ScrollbarPart hoveredPart() const OVERRIDE;
+    virtual void styleChanged() OVERRIDE;
+    virtual bool enabled() const OVERRIDE;
+    virtual void setEnabled(bool) OVERRIDE;
+    virtual bool isOverlayScrollbar() const OVERRIDE;
+
+private:
+    WebKit::WebScrollbar* m_scrollbar;
+};
+
+}
+
+#endif // WebScrollbarThemeClientImpl_h
diff --git a/Source/WebKit/chromium/src/WebScrollbarThemePainter.cpp b/Source/WebKit/chromium/src/WebScrollbarThemePainter.cpp
new file mode 100644
index 000000000..a96fdca45
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarThemePainter.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebScrollbarThemePainter.h>
+
+#include "PlatformContextSkia.h"
+#include "Scrollbar.h"
+#include "ScrollbarThemeComposite.h"
+#include <public/WebRect.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebScrollbarThemePainter::assign(const WebScrollbarThemePainter& painter)
+{
+    // This is a pointer to a static object, so no ownership transferral.
+    m_theme = painter.m_theme;
+    m_scrollbar = painter.m_scrollbar;
+}
+
+void WebScrollbarThemePainter::paintScrollbarBackground(WebCanvas* canvas, const WebRect& rect)
+{
+    SkRect clip = SkRect::MakeXYWH(rect.x, rect.y, rect.width, rect.height);
+    canvas->clipRect(clip);
+
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintScrollbarBackground(&context, m_scrollbar);
+}
+
+void WebScrollbarThemePainter::paintTrackBackground(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTrackBackground(&context, m_scrollbar, IntRect(rect));
+}
+
+void WebScrollbarThemePainter::paintBackTrackPart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTrackPiece(&context, m_scrollbar, IntRect(rect), WebCore::BackTrackPart);
+}
+
+void WebScrollbarThemePainter::paintForwardTrackPart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTrackPiece(&context, m_scrollbar, IntRect(rect), WebCore::ForwardTrackPart);
+}
+
+void WebScrollbarThemePainter::paintBackButtonStart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::BackButtonStartPart);
+}
+
+void WebScrollbarThemePainter::paintBackButtonEnd(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::BackButtonEndPart);
+}
+
+void WebScrollbarThemePainter::paintForwardButtonStart(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::ForwardButtonStartPart);
+}
+
+void WebScrollbarThemePainter::paintForwardButtonEnd(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintButton(&context, m_scrollbar, IntRect(rect), WebCore::ForwardButtonEndPart);
+}
+
+void WebScrollbarThemePainter::paintTickmarks(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintTickmarks(&context, m_scrollbar, IntRect(rect));
+}
+
+void WebScrollbarThemePainter::paintThumb(WebCanvas* canvas, const WebRect& rect)
+{
+    PlatformContextSkia platformContext(canvas);
+    platformContext.setDrawingToImageBuffer(true);
+    GraphicsContext context(&platformContext);
+    m_theme->paintThumb(&context, m_scrollbar, IntRect(rect));
+}
+
+WebScrollbarThemePainter::WebScrollbarThemePainter(WebCore::ScrollbarThemeComposite* theme, WebCore::Scrollbar* scrollbar)
+    : m_theme(theme)
+    , m_scrollbar(scrollbar)
+{
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index 5c57cf8ca..eb4b7bb76 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -47,10 +47,10 @@ namespace WebKit {
 
 WebSettingsImpl::WebSettingsImpl(Settings* settings)
     : m_settings(settings)
-    , m_forceSoftwareCompositing(false)
     , m_showFPSCounter(false)
     , m_showPlatformLayerTree(false)
     , m_showPaintRects(false)
+    , m_renderVSyncEnabled(true)
     , m_viewportEnabled(false)
     , m_applyDefaultDeviceScaleFactorInCompositor(false)
     , m_defaultTileSize(WebSize(256, 256))
@@ -148,6 +148,15 @@ void WebSettingsImpl::setTextAutosizingEnabled(bool enabled)
 #endif
 }
 
+void WebSettingsImpl::setTextAutosizingFontScaleFactor(float fontScaleFactor)
+{
+#if ENABLE(TEXT_AUTOSIZING)
+    m_settings->setTextAutosizingFontScaleFactor(fontScaleFactor);
+#else
+    UNUSED_PARAM(fontScaleFactor);
+#endif
+}
+
 void WebSettingsImpl::setDefaultTextEncodingName(const WebString& encoding)
 {
     m_settings->setDefaultTextEncodingName((String)encoding);
@@ -357,6 +366,11 @@ void WebSettingsImpl::setPrivilegedWebGLExtensionsEnabled(bool enabled)
     m_settings->setPrivilegedWebGLExtensionsEnabled(enabled);
 }
 
+void WebSettingsImpl::setRenderVSyncEnabled(bool enabled)
+{
+    m_renderVSyncEnabled = enabled;
+}
+
 void WebSettingsImpl::setWebGLErrorsToConsoleEnabled(bool enabled)
 {
     m_settings->setWebGLErrorsToConsoleEnabled(enabled);
@@ -398,11 +412,6 @@ void WebSettingsImpl::setForceCompositingMode(bool enabled)
     m_settings->setForceCompositingMode(enabled);
 }
 
-void WebSettingsImpl::setForceSoftwareCompositing(bool enabled)
-{
-    m_forceSoftwareCompositing = enabled;
-}
-
 void WebSettingsImpl::setMockScrollbarsEnabled(bool enabled)
 {
     m_settings->setMockScrollbarsEnabled(enabled);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index 76e30b52f..7bc8a649a 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -45,7 +45,6 @@ public:
     virtual ~WebSettingsImpl() { }
 
     virtual bool deviceSupportsTouch();
-    virtual bool forceSoftwareCompositing() const { return m_forceSoftwareCompositing; }
     virtual bool scrollAnimatorEnabled() const;
     virtual bool viewportEnabled() const { return m_viewportEnabled; }
     virtual void setAccelerated2dCanvasEnabled(bool);
@@ -94,7 +93,6 @@ public:
     virtual void setFixedPositionCreatesStackingContext(bool);
     virtual void setFontRenderingModeNormal();
     virtual void setForceCompositingMode(bool);
-    virtual void setForceSoftwareCompositing(bool);
     virtual void setFrameFlatteningEnabled(bool);
     virtual void setFullScreenEnabled(bool);
     virtual void setHyperlinkAuditingEnabled(bool);
@@ -124,6 +122,7 @@ public:
     virtual void setPictographFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
     virtual void setPluginsEnabled(bool);
     virtual void setPrivilegedWebGLExtensionsEnabled(bool);
+    virtual void setRenderVSyncEnabled(bool);
     virtual void setSansSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
     virtual void setSerifFontFamily(const WebString&, UScriptCode = USCRIPT_COMMON);
     virtual void setShouldDisplayCaptions(bool);
@@ -139,6 +138,7 @@ public:
     virtual void setSyncXHRInDocumentsEnabled(bool);
     virtual void setTextAreasAreResizable(bool);
     virtual void setTextAutosizingEnabled(bool);
+    virtual void setTextAutosizingFontScaleFactor(float);
     virtual void setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
     virtual void setUnifiedTextCheckerEnabled(bool);
     virtual void setUserStyleSheetLocation(const WebURL&);
@@ -155,16 +155,17 @@ public:
     bool showFPSCounter() const { return m_showFPSCounter; }
     bool showPlatformLayerTree() const { return m_showPlatformLayerTree; }
     bool showPaintRects() const { return m_showPaintRects; }
+    bool renderVSyncEnabled() const { return m_renderVSyncEnabled; }
     bool applyDefaultDeviceScaleFactorInCompositor() const { return m_applyDefaultDeviceScaleFactorInCompositor; }
     WebSize defaultTileSize() const { return m_defaultTileSize; }
     WebSize maxUntiledLayerSize() const { return m_maxUntiledLayerSize; }
 
 private:
     WebCore::Settings* m_settings;
-    bool m_forceSoftwareCompositing;
     bool m_showFPSCounter;
     bool m_showPlatformLayerTree;
     bool m_showPaintRects;
+    bool m_renderVSyncEnabled;
     bool m_viewportEnabled;
     bool m_applyDefaultDeviceScaleFactorInCompositor;
     WebSize m_defaultTileSize;
diff --git a/Source/WebKit/chromium/src/WebSocketImpl.cpp b/Source/WebKit/chromium/src/WebSocketImpl.cpp
index 179303ad9..7548c6315 100644
--- a/Source/WebKit/chromium/src/WebSocketImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSocketImpl.cpp
@@ -126,7 +126,7 @@ bool WebSocketImpl::sendText(const WebString& message)
 bool WebSocketImpl::sendArrayBuffer(const WebArrayBuffer& webArrayBuffer)
 {
 #if ENABLE(WEB_SOCKETS)
-    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer)) == ThreadableWebSocketChannel::SendSuccess;
+    return m_private->send(*PassRefPtr<ArrayBuffer>(webArrayBuffer), 0, webArrayBuffer.byteLength()) == ThreadableWebSocketChannel::SendSuccess;
 #else
     ASSERT_NOT_REACHED();
 #endif
diff --git a/Source/WebKit/chromium/src/WebSolidColorLayer.cpp b/Source/WebKit/chromium/src/WebSolidColorLayer.cpp
index 11d7c1417..83914b263 100644
--- a/Source/WebKit/chromium/src/WebSolidColorLayer.cpp
+++ b/Source/WebKit/chromium/src/WebSolidColorLayer.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-#include "platform/WebSolidColorLayer.h"
+#include <public/WebSolidColorLayer.h>
 
 #include "WebSolidColorLayerImpl.h"
-#include "platform/WebFloatRect.h"
+#include <public/WebFloatRect.h>
 
 namespace WebKit {
 
diff --git a/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp b/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp
index 9764af138..a0f7a4b0b 100644
--- a/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewBenchmarkSupportImpl.cpp
@@ -59,7 +59,8 @@ void WebViewBenchmarkSupportImpl::acceleratedPaintUnclipped(PaintClient* paintCl
     FloatSize layerSize = layer.size();
     IntRect clip(0, 0, layerSize.width(), layerSize.height());
 
-    paintLayer(paintClient, layer, clip);
+    if (layer.drawsContent())
+        paintLayer(paintClient, layer, clip);
 
     const Vector<GraphicsLayer*>& children = layer.children();
     Vector<GraphicsLayer*>::const_iterator it;
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 7c6da60d9..0bd3ea116 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -42,6 +42,7 @@
 #include "Color.h"
 #include "ColorSpace.h"
 #include "CompositionUnderlineVectorBuilder.h"
+#include "CompositorHUDFontAtlas.h"
 #include "ContextFeaturesClientImpl.h"
 #include "ContextMenu.h"
 #include "ContextMenuController.h"
@@ -81,7 +82,6 @@
 #include "InspectorInstrumentation.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
-#include "LayerChromium.h"
 #include "LayerPainterChromium.h"
 #include "MIMETypeRegistry.h"
 #include "NodeRenderStyle.h"
@@ -97,7 +97,6 @@
 #include "PlatformMouseEvent.h"
 #include "PlatformThemeChromiumLinux.h"
 #include "PlatformWheelEvent.h"
-#include "PointerLock.h"
 #include "PointerLockController.h"
 #include "PopupContainer.h"
 #include "PopupMenuClient.h"
@@ -133,7 +132,6 @@
 #include "WebInputElement.h"
 #include "WebInputEvent.h"
 #include "WebInputEventConversion.h"
-#include "WebKit.h"
 #include "WebMediaPlayerAction.h"
 #include "WebNode.h"
 #include "WebPagePopupImpl.h"
@@ -145,15 +143,13 @@
 #include "WebRuntimeFeatures.h"
 #include "WebSettingsImpl.h"
 #include "WebTextInputInfo.h"
+#include "WebTouchCandidatesInfo.h"
 #include "WebViewClient.h"
 #include "WheelEvent.h"
-#include "cc/CCProxy.h"
-#include "cc/CCSettings.h"
 #include "painting/GraphicsContextBuilder.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebString.h"
-#include "platform/WebVector.h"
 #include <public/Platform.h>
+#include <public/WebCompositor.h>
+#include <public/WebCompositorOutputSurface.h>
 #include <public/WebDragData.h>
 #include <public/WebFloatPoint.h>
 #include <public/WebGraphicsContext3D.h>
@@ -162,6 +158,8 @@
 #include <public/WebLayerTreeView.h>
 #include <public/WebPoint.h>
 #include <public/WebRect.h>
+#include <public/WebString.h>
+#include <public/WebVector.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefPtr.h>
@@ -195,7 +193,7 @@ static const int touchPointPadding = 32;
 static const float minScaleDifference = 0.01f;
 static const float doubleTapZoomContentDefaultMargin = 5;
 static const float doubleTapZoomContentMinimumMargin = 2;
-static const double doubleTabZoomAnimationDurationInSeconds = 0.25;
+static const double doubleTapZoomAnimationDurationInSeconds = 0.25;
 
 // Constants for zooming in on a focused text field.
 static const double scrollAndScaleAnimationDurationInSeconds = 0.2;
@@ -763,15 +761,25 @@ void WebViewImpl::transferActiveWheelFlingAnimation(const WebActiveWheelFlingPar
 
 void WebViewImpl::renderingStats(WebRenderingStats& stats) const
 {
-    ASSERT(isAcceleratedCompositingActive());
     if (!m_layerTreeView.isNull())
         m_layerTreeView.renderingStats(stats);
 }
 
-void WebViewImpl::startPageScaleAnimation(const IntPoint& scroll, bool useAnchor, float newScale, double durationInSeconds)
+void WebViewImpl::startPageScaleAnimation(const IntPoint& targetPosition, bool useAnchor, float newScale, double durationInSeconds)
 {
-    if (!m_layerTreeView.isNull())
-        m_layerTreeView.startPageScaleAnimation(scroll, useAnchor, newScale, durationInSeconds);
+    if (m_layerTreeView.isNull())
+        return;
+
+    IntPoint clampedPoint = targetPosition;
+    if (!useAnchor)
+        clampedPoint = clampOffsetAtScale(targetPosition, newScale);
+
+    if (!durationInSeconds && !useAnchor) {
+        setPageScaleFactor(newScale, clampedPoint);
+        return;
+    }
+
+    m_layerTreeView.startPageScaleAnimation(targetPosition, useAnchor, newScale, durationInSeconds);
 }
 #endif
 
@@ -780,6 +788,17 @@ WebViewBenchmarkSupport* WebViewImpl::benchmarkSupport()
     return &m_benchmarkSupport;
 }
 
+WebVector<WebFloatQuad> WebViewImpl::getTouchHighlightQuads(const WebPoint& point,
+                                                            int padding,
+                                                            WebTouchCandidatesInfo& outTouchInfo,
+                                                            WebColor& outTapHighlightColor)
+{
+    // FIXME: Upstream this function from the chromium-android branch.
+    notImplemented();
+
+    return WebVector<WebFloatQuad>();
+}
+
 bool WebViewImpl::handleKeyEvent(const WebKeyboardEvent& event)
 {
     ASSERT((event.type == WebInputEvent::RawKeyDown)
@@ -1112,7 +1131,7 @@ void WebViewImpl::animateZoomAroundPoint(const IntPoint& point, AutoZoomType zoo
     computeScaleAndScrollForHitRect(WebRect(point.x(), point.y(), 0, 0), zoomType, scale, scroll);
 
     bool isDoubleTap = (zoomType == DoubleTap);
-    double durationInSeconds = isDoubleTap ? doubleTabZoomAnimationDurationInSeconds : 0;
+    double durationInSeconds = isDoubleTap ? doubleTapZoomAnimationDurationInSeconds : 0;
     startPageScaleAnimation(scroll, isDoubleTap, scale, durationInSeconds);
 #endif
 }
@@ -1611,7 +1630,7 @@ void WebViewImpl::didBeginFrame()
 void WebViewImpl::updateAnimations(double monotonicFrameBeginTime)
 {
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-    TRACE_EVENT("WebViewImpl::updateAnimations", this, 0);
+    TRACE_EVENT0("webkit", "WebViewImpl::updateAnimations");
 
     WebFrameImpl* webframe = mainFrameImpl();
     if (!webframe)
@@ -1634,7 +1653,7 @@ void WebViewImpl::updateAnimations(double monotonicFrameBeginTime)
 
 void WebViewImpl::layout()
 {
-    TRACE_EVENT("WebViewImpl::layout", this, 0);
+    TRACE_EVENT0("webkit", "WebViewImpl::layout");
     PageWidgetDelegate::layout(m_page.get());
 }
 
@@ -1677,7 +1696,7 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
         if (canvas) {
             // Clip rect to the confines of the rootLayerTexture.
             IntRect resizeRect(rect);
-            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeView.viewportSize()));
+            resizeRect.intersect(IntRect(IntPoint(0, 0), m_layerTreeView.deviceViewportSize()));
             doPixelReadbackToCanvas(canvas, resizeRect);
         }
 #endif
@@ -1704,7 +1723,7 @@ void WebViewImpl::themeChanged()
 void WebViewImpl::composite(bool)
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (CCProxy::hasImplThread())
+    if (WebCompositor::threadingEnabled())
         m_layerTreeView.setNeedsRedraw();
     else {
         ASSERT(isAcceleratedCompositingActive());
@@ -3509,7 +3528,7 @@ void WebViewImpl::setRootGraphicsLayer(GraphicsLayer* layer)
     }
 
     if (layer)
-        m_rootLayer = WebLayer(layer->platformLayer());
+        m_rootLayer = *layer->platformLayer();
 
     if (!m_layerTreeView.isNull())
         m_layerTreeView.setRootLayer(layer ? &m_rootLayer : 0);
@@ -3564,7 +3583,7 @@ WebCore::GraphicsLayer* WebViewImpl::rootGraphicsLayer()
 void WebViewImpl::scheduleAnimation()
 {
     if (isAcceleratedCompositingActive()) {
-        if (CCProxy::hasImplThread()) {
+        if (WebCompositor::threadingEnabled()) {
             ASSERT(!m_layerTreeView.isNull());
             m_layerTreeView.setNeedsAnimate();
         } else
@@ -3609,14 +3628,14 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
         m_client->didActivateCompositor(m_layerTreeView.compositorIdentifier());
     } else {
-        TRACE_EVENT("WebViewImpl::setIsAcceleratedCompositingActive(true)", this, 0);
+        TRACE_EVENT0("webkit", "WebViewImpl::setIsAcceleratedCompositingActive(true)");
 
         WebLayerTreeView::Settings layerTreeViewSettings;
         layerTreeViewSettings.acceleratePainting = page()->settings()->acceleratedDrawingEnabled();
         layerTreeViewSettings.showFPSCounter = settingsImpl()->showFPSCounter();
         layerTreeViewSettings.showPlatformLayerTree = settingsImpl()->showPlatformLayerTree();
         layerTreeViewSettings.showPaintRects = settingsImpl()->showPaintRects();
-        layerTreeViewSettings.forceSoftwareCompositing = settings()->forceSoftwareCompositing();
+        layerTreeViewSettings.renderVSyncEnabled = settingsImpl()->renderVSyncEnabled();
 
         layerTreeViewSettings.defaultTileSize = settingsImpl()->defaultTileSize();
         layerTreeViewSettings.maxUntiledLayerSize = settingsImpl()->maxUntiledLayerSize();
@@ -3646,6 +3665,15 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
             m_compositorCreationFailed = false;
             if (m_pageOverlays)
                 m_pageOverlays->update();
+
+            // Only allocate the font atlas if we have reason to use the heads-up display.
+            if (layerTreeViewSettings.showFPSCounter || layerTreeViewSettings.showPlatformLayerTree) {
+                TRACE_EVENT0("cc", "WebViewImpl::setIsAcceleratedCompositingActive(true) initialize font atlas");
+                WebRect asciiToRectTable[128];
+                int fontHeight;
+                SkBitmap bitmap = WebCore::CompositorHUDFontAtlas::generateFontAtlas(asciiToRectTable, fontHeight);
+                m_layerTreeView.setFontAtlas(bitmap, asciiToRectTable, fontHeight);
+            }
         } else {
             m_nonCompositedContentHost.clear();
             m_isAcceleratedCompositingActive = false;
@@ -3659,47 +3687,63 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
 
 #endif
 
-PassOwnPtr<WebKit::WebGraphicsContext3D> WebViewImpl::createCompositorGraphicsContext3D()
-{
-    if (settings()->forceSoftwareCompositing())
-        CRASH();
+namespace {
+
+// Adapts a pure WebGraphicsContext3D into a WebCompositorOutputSurface until
+// downstream code can be updated to produce output surfaces directly.
+class WebGraphicsContextToOutputSurfaceAdapter : public WebCompositorOutputSurface {
+public:
+    explicit WebGraphicsContextToOutputSurfaceAdapter(PassOwnPtr<WebGraphicsContext3D> context)
+        : m_context3D(context)
+        , m_client(0)
+    {
+    }
+
+    virtual bool bindToClient(WebCompositorOutputSurfaceClient* client) OVERRIDE
+    {
+        ASSERT(client);
+        if (!m_context3D->makeContextCurrent())
+            return false;
+        m_client = client;
+        return true;
+    }
+
+    virtual const Capabilities& capabilities() const OVERRIDE
+    {
+        return m_capabilities;
+    }
+
+    virtual WebGraphicsContext3D* context3D() const OVERRIDE
+    {
+        return m_context3D.get();
+    }
+
+    virtual void sendFrameToParentCompositor(const WebCompositorFrame&) OVERRIDE
+    {
+    }
 
-    // Explicitly disable antialiasing for the compositor. As of the time of
-    // this writing, the only platform that supported antialiasing for the
-    // compositor was Mac OS X, because the on-screen OpenGL context creation
-    // code paths on Windows and Linux didn't yet have multisampling support.
-    // Mac OS X essentially always behaves as though it's rendering offscreen.
-    // Multisampling has a heavy cost especially on devices with relatively low
-    // fill rate like most notebooks, and the Mac implementation would need to
-    // be optimized to resolve directly into the IOSurface shared between the
-    // GPU and browser processes. For these reasons and to avoid platform
-    // disparities we explicitly disable antialiasing.
+private:
+    OwnPtr<WebGraphicsContext3D> m_context3D;
+    Capabilities m_capabilities;
+    WebCompositorOutputSurfaceClient* m_client;
+};
+
+} // namespace
+
+WebGraphicsContext3D* WebViewImpl::createContext3D()
+{
+    // Temporarily, if the output surface can't be created, create a WebGraphicsContext3D
+    // directly. This allows bootstrapping the output surface system while downstream
+    // users of the API still use the old approach.
     WebKit::WebGraphicsContext3D::Attributes attributes;
     attributes.antialias = false;
     attributes.shareResources = true;
-
-    OwnPtr<WebGraphicsContext3D> webContext = adoptPtr(client()->createGraphicsContext3D(attributes));
-    if (!webContext)
-        return nullptr;
-
-    return webContext.release();
+    return m_client->createGraphicsContext3D(attributes);
 }
 
-WebKit::WebGraphicsContext3D* WebViewImpl::createContext3D()
+WebCompositorOutputSurface* WebViewImpl::createOutputSurface()
 {
-    if (settings()->forceSoftwareCompositing())
-        CRASH();
-
-    OwnPtr<WebKit::WebGraphicsContext3D> webContext;
-
-    // If we've already created an onscreen context for this view, return that.
-    if (m_temporaryOnscreenGraphicsContext3D)
-        webContext = m_temporaryOnscreenGraphicsContext3D.release();
-    else // Otherwise make a new one.
-        webContext = createCompositorGraphicsContext3D();
-    // The caller takes ownership of this object, but since there's no equivalent of PassOwnPtr<> in the WebKit API
-    // we return a raw pointer.
-    return webContext.leakPtr();
+    return m_client->createOutputSurface();
 }
 
 void WebViewImpl::applyScrollAndScale(const WebSize& scrollDelta, float pageScaleDelta)
@@ -3749,7 +3793,11 @@ void WebViewImpl::didCompleteSwapBuffers()
 
 void WebViewImpl::didRebindGraphicsContext(bool success)
 {
+    didRecreateOutputSurface(success);
+}
 
+void WebViewImpl::didRecreateOutputSurface(bool success)
+{
     // Switch back to software rendering mode, if necessary
     if (!success) {
         ASSERT(m_isAcceleratedCompositingActive);
@@ -3768,7 +3816,7 @@ void WebViewImpl::didRebindGraphicsContext(bool success)
 
 void WebViewImpl::scheduleComposite()
 {
-    ASSERT(!CCProxy::hasImplThread());
+    ASSERT(!WebCompositor::threadingEnabled());
     m_client->scheduleComposite();
 }
 
@@ -3786,7 +3834,10 @@ void WebViewImpl::updateLayerTreeViewport()
     float deviceScale = m_deviceScaleInCompositor;
     m_nonCompositedContentHost->setViewport(visibleRect.size(), view->contentsSize(), scroll, view->scrollOrigin(), deviceScale);
 
-    m_layerTreeView.setViewportSize(size());
+    IntSize layoutViewportSize = size();
+    IntSize deviceViewportSize = size();
+    deviceViewportSize.scale(deviceScale);
+    m_layerTreeView.setViewportSize(layoutViewportSize, deviceViewportSize);
     m_layerTreeView.setPageScaleFactorAndLimits(pageScaleFactor(), m_minimumPageScaleFactor, m_maximumPageScaleFactor);
 }
 
@@ -3804,6 +3855,34 @@ void WebViewImpl::selectAutofillSuggestionAtIndex(unsigned listIndex)
         m_autofillPopupClient->valueChanged(listIndex);
 }
 
+bool WebViewImpl::detectContentIntentOnTouch(const WebPoint& position, WebInputEvent::Type touchType)
+{
+    ASSERT(touchType == WebInputEvent::GestureTap || touchType == WebInputEvent::GestureLongPress);
+    HitTestResult touchHit = hitTestResultForWindowPos(position);
+
+    if (touchHit.isContentEditable())
+        return false;
+
+    Node* node = touchHit.innerNode();
+    if (!node || !node->isTextNode())
+        return false;
+
+    // FIXME: Should we not detect content intents in nodes that have event listeners?
+
+    WebContentDetectionResult content = m_client->detectContentIntentAround(touchHit);
+    if (!content.isValid())
+        return false;
+
+    if (touchType == WebInputEvent::GestureLongPress) {
+        // Select the detected content as a block.
+        focusedFrame()->selectRange(content.range());
+        return true;
+    }
+
+    m_client->scheduleContentIntent(content.intent());
+    return true;
+}
+
 void WebViewImpl::setVisibilityState(WebPageVisibilityState visibilityState,
                                      bool isInitialState) {
     if (!page())
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index 639d5e61a..39783680f 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -31,16 +31,6 @@
 #ifndef WebViewImpl_h
 #define WebViewImpl_h
 
-#include "WebNavigationPolicy.h"
-#include "platform/WebLayer.h"
-#include "platform/WebLayerTreeView.h"
-#include "platform/WebLayerTreeViewClient.h"
-#include "platform/WebPoint.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
-#include "platform/WebString.h"
-#include "WebView.h"
-
 #include "ChromeClientImpl.h"
 #include "ContextMenuClientImpl.h"
 #include "DragClientImpl.h"
@@ -56,7 +46,18 @@
 #include "PageWidgetDelegate.h"
 #include "PlatformGestureCurveTarget.h"
 #include "UserMediaClientImpl.h"
+#include "WebInputEvent.h"
+#include "WebNavigationPolicy.h"
+#include "WebView.h"
 #include "WebViewBenchmarkSupportImpl.h"
+#include <public/WebFloatQuad.h>
+#include <public/WebLayer.h>
+#include <public/WebLayerTreeView.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebPoint.h>
+#include <public/WebRect.h>
+#include <public/WebSize.h>
+#include <public/WebString.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 
@@ -301,13 +302,20 @@ public:
     virtual void transferActiveWheelFlingAnimation(const WebActiveWheelFlingParameters&);
     virtual WebViewBenchmarkSupport* benchmarkSupport();
 
+    virtual WebVector<WebFloatQuad> getTouchHighlightQuads(const WebPoint&,
+                                                           int padding,
+                                                           WebTouchCandidatesInfo& outTouchInfo,
+                                                           WebColor& outTapHighlightColor);
+
     // WebLayerTreeViewClient
     virtual void willBeginFrame();
     virtual void didBeginFrame();
     virtual void updateAnimations(double monotonicFrameBeginTime);
     virtual void applyScrollAndScale(const WebSize&, float);
-    virtual WebGraphicsContext3D* createContext3D();
-    virtual void didRebindGraphicsContext(bool);
+    virtual WebGraphicsContext3D* createContext3D() OVERRIDE;
+    virtual void didRebindGraphicsContext(bool success) OVERRIDE;
+    virtual WebCompositorOutputSurface* createOutputSurface() OVERRIDE;
+    virtual void didRecreateOutputSurface(bool success) OVERRIDE;
     virtual void willCommit();
     virtual void didCommit();
     virtual void didCommitAndDrawFrame();
@@ -382,6 +390,8 @@ public:
     // Event related methods:
     void mouseContextMenu(const WebMouseEvent&);
     void mouseDoubleClick(const WebMouseEvent&);
+
+    bool detectContentIntentOnTouch(const WebPoint&, WebInputEvent::Type);
     void startPageScaleAnimation(const WebCore::IntPoint& targetPosition, bool useAnchor, float newScale, double durationInSeconds);
 
     void numberOfWheelEventHandlersChanged(unsigned);
@@ -529,8 +539,6 @@ public:
 
     virtual WebGraphicsContext3D* sharedGraphicsContext3D();
 
-    PassOwnPtr<WebGraphicsContext3D> createCompositorGraphicsContext3D();
-
     virtual void setVisibilityState(WebPageVisibilityState, bool);
 
     WebCore::PopupContainer* selectPopup() const { return m_selectPopup.get(); }
@@ -824,10 +832,6 @@ private:
     OwnPtr<SpeechRecognitionClientProxy> m_speechRecognitionClient;
 #endif
 
-    // If we attempt to fetch the on-screen GraphicsContext3D before
-    // the compositor has been turned on, we need to instantiate it
-    // early. This member holds on to the GC3D in this case.
-    OwnPtr<WebGraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
     OwnPtr<GeolocationClientProxy> m_geolocationClientProxy;
 #if ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index 80899919b..c6fd50589 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -59,13 +59,11 @@
 #include "PlatformMessagePortChannel.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "WebMessagePortChannel.h"
 #include "WebPermissionClient.h"
-#include "platform/WebString.h"
-#include "platform/WebURL.h"
 #include "WebViewImpl.h"
+#include <public/WebString.h>
+#include <public/WebURL.h>
 
 using namespace WebCore;
 
diff --git a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
index 7a387c7ed..4a5f69dc2 100644
--- a/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
+++ b/Source/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
@@ -40,8 +40,6 @@
 #include "NotImplemented.h"
 #include "WebFileSystemCallbacksImpl.h"
 #include "WebFileWriter.h"
-#include "WebKit.h"
-#include "platform/WebKitPlatformSupport.h"
 #include "WebWorkerBase.h"
 #include "WorkerAsyncFileWriterChromium.h"
 #include "WorkerContext.h"
diff --git a/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp b/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp
index 3ffb178c5..dd91c52a2 100644
--- a/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp
+++ b/Source/WebKit/chromium/src/WorkerFileWriterCallbacksBridge.cpp
@@ -35,14 +35,13 @@
 
 #include "AsyncFileWriterClient.h"
 #include "CrossThreadTask.h"
-#include "platform/WebCString.h"
 #include "WebFileWriter.h"
-#include "WebKit.h"
 #include "WebWorkerBase.h"
 #include "WorkerContext.h"
 #include "WorkerLoaderProxy.h"
 #include "WorkerThread.h"
 #include <public/Platform.h>
+#include <public/WebCString.h>
 #include <public/WebFileSystem.h>
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
diff --git a/Source/WebKit/chromium/src/js/DevTools.js b/Source/WebKit/chromium/src/js/DevTools.js
index 12293f5b1..f555419e9 100644
--- a/Source/WebKit/chromium/src/js/DevTools.js
+++ b/Source/WebKit/chromium/src/js/DevTools.js
@@ -39,7 +39,6 @@
     Preferences.localizeUI = false;
     Preferences.applicationTitle = "Developer Tools - %s";
     Preferences.exposeDisableCache = true;
-    Preferences.exposeWorkersInspection = true;
     Preferences.showDockToRight = true;
     Preferences.exposeFileSystemInspection = true;
 })();}
diff --git a/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm b/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
index e1b94a640..babb1f6cc 100644
--- a/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
+++ b/Source/WebKit/chromium/src/mac/WebInputEventFactory.mm
@@ -43,8 +43,7 @@ enum {
     NSEventPhaseStationary  = 0x1 << 1,
     NSEventPhaseChanged     = 0x1 << 2,
     NSEventPhaseEnded       = 0x1 << 3,
-    NSEventPhaseCancelled   = 0x1 << 4,
-    NSEventPhaseMayBegin    = 0x1 << 5
+    NSEventPhaseCancelled   = 0x1 << 4
 };
 typedef NSUInteger NSEventPhase;
 
@@ -55,6 +54,15 @@ typedef NSUInteger NSEventPhase;
 
 #endif  // __MAC_OS_X_VERSION_MAX_ALLOWED < 1070
 
+#if __MAC_OS_X_VERSION_MAX_ALLOWED < 1080
+
+// Additional Mountain Lion APIs.
+enum {
+    NSEventPhaseMayBegin    = 0x1 << 5
+};
+
+#endif  // __MAC_OS_X_VERSION_MAX_ALLOWED < 1080
+
 // Do not __MAC_OS_X_VERSION_MAX_ALLOWED here because of a bug in the 10.5 SDK,
 // see <http://lists.webkit.org/pipermail/webkit-dev/2012-July/021442.html>.
 #if MAC_OS_X_VERSION_MAX_ALLOWED <= 1050
@@ -759,7 +767,7 @@ WebMouseEvent WebInputEventFactory::mouseEvent(NSEvent* event, NSView* view)
 
 static WebMouseWheelEvent::Phase phaseForNSEventPhase(NSEventPhase eventPhase)
 {
-    uint32_t phase = WebMouseWheelEvent::PhaseNone; 
+    uint32_t phase = WebMouseWheelEvent::PhaseNone;
     if (eventPhase & NSEventPhaseBegan)
         phase |= WebMouseWheelEvent::PhaseBegan;
     if (eventPhase & NSEventPhaseStationary)
@@ -770,6 +778,8 @@ static WebMouseWheelEvent::Phase phaseForNSEventPhase(NSEventPhase eventPhase)
         phase |= WebMouseWheelEvent::PhaseEnded;
     if (eventPhase & NSEventPhaseCancelled)
         phase |= WebMouseWheelEvent::PhaseCancelled;
+    if (eventPhase & NSEventPhaseMayBegin)
+        phase |= WebMouseWheelEvent::PhaseMayBegin;
     return static_cast<WebMouseWheelEvent::Phase>(phase);
 }
 
diff --git a/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp b/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
index 854595380..f210c1bb7 100644
--- a/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCAnimationTestCommon.cpp
@@ -26,9 +26,7 @@
 
 #include "CCAnimationTestCommon.h"
 
-#include "GraphicsLayer.h"
 #include "LayerChromium.h"
-#include "TranslateTransformOperation.h"
 #include "cc/CCKeyframedAnimationCurve.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
diff --git a/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp b/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
index 8294ca622..8f813b9ba 100644
--- a/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCDamageTrackerTest.cpp
@@ -55,7 +55,7 @@ void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* root, Vector<CCLay
     ASSERT_FALSE(renderSurfaceLayerList.size());
 
     CCLayerTreeHostCommon::calculateDrawTransforms(root, root->bounds(), 1, &layerSorter, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, root->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 }
 
 void clearDamageForAllSurfaces(CCLayerImpl* layer)
diff --git a/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp b/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp
index 93e84a4af..08b5d8202 100644
--- a/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp
+++ b/Source/WebKit/chromium/tests/CCDelayBasedTimeSourceTest.cpp
@@ -199,6 +199,120 @@ TEST(CCDelayBasedTimeSource, NextDelaySaneWhenHalfAfterRequestedTime)
     EXPECT_EQ(8, thread.pendingDelayMs());
 }
 
+// If the timebase and interval are updated with a jittery source, we want to
+// make sure we do not double tick.
+TEST(CCDelayBasedTimeSource, SaneHandlingOfJitteryTimebase)
+{
+    FakeCCThread thread;
+    FakeCCTimeSourceClient client;
+    double interval = 1.0 / 60.0;
+    RefPtr<FakeCCDelayBasedTimeSource> timer = FakeCCDelayBasedTimeSource::create(interval, &thread);
+    timer->setClient(&client);
+    timer->setActive(true);
+    // Run the first task, as that activates the timer and picks up a timebase.
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    // Jitter timebase ~1ms late
+    timer->setTimebaseAndInterval(interval + 0.001, interval);
+    timer->setMonotonicallyIncreasingTime(interval);
+    thread.runPendingTask();
+
+    // Without double tick prevention, pendingDelayMs would be 1.
+    EXPECT_EQ(17, thread.pendingDelayMs());
+
+    // Jitter timebase ~1ms early
+    timer->setTimebaseAndInterval(interval * 2 - 0.001, interval);
+    timer->setMonotonicallyIncreasingTime(interval * 2);
+    thread.runPendingTask();
+
+    EXPECT_EQ(15, thread.pendingDelayMs());
+}
+
+TEST(CCDelayBasedTimeSource, HanldlesSignificantTimebaseChangesImmediately)
+{
+    FakeCCThread thread;
+    FakeCCTimeSourceClient client;
+    double interval = 1.0 / 60.0;
+    RefPtr<FakeCCDelayBasedTimeSource> timer = FakeCCDelayBasedTimeSource::create(interval, &thread);
+    timer->setClient(&client);
+    timer->setActive(true);
+    // Run the first task, as that activates the timer and picks up a timebase.
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    // Tick, then shift timebase by +7ms.
+    timer->setMonotonicallyIncreasingTime(interval);
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval + 0.0070001, interval);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(7, thread.pendingDelayMs());
+
+    // Tick, then shift timebase by -7ms.
+    timer->setMonotonicallyIncreasingTime(interval + 0.0070001);
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval, interval);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(16-7, thread.pendingDelayMs());
+}
+
+TEST(CCDelayBasedTimeSource, HanldlesSignificantIntervalChangesImmediately)
+{
+    FakeCCThread thread;
+    FakeCCTimeSourceClient client;
+    double interval = 1.0 / 60.0;
+    RefPtr<FakeCCDelayBasedTimeSource> timer = FakeCCDelayBasedTimeSource::create(interval, &thread);
+    timer->setClient(&client);
+    timer->setActive(true);
+    // Run the first task, as that activates the timer and picks up a timebase.
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    // Tick, then double the interval.
+    timer->setMonotonicallyIncreasingTime(interval);
+    thread.runPendingTask();
+
+    EXPECT_EQ(16, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval, interval * 2);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(33, thread.pendingDelayMs());
+
+    // Tick, then halve the interval.
+    timer->setMonotonicallyIncreasingTime(interval * 3);
+    thread.runPendingTask();
+
+    EXPECT_EQ(33, thread.pendingDelayMs());
+
+    client.reset();
+    thread.runPendingTaskOnOverwrite(true);
+    timer->setTimebaseAndInterval(interval * 3, interval);
+    thread.runPendingTaskOnOverwrite(false);
+
+    EXPECT_FALSE(client.tickCalled()); // Make sure pending tasks were canceled.
+    EXPECT_EQ(16, thread.pendingDelayMs());
+}
 
 TEST(CCDelayBasedTimeSourceTest, AchievesTargetRateWithNoNoise)
 {
diff --git a/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp b/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp
index c9a60cfaa..20f2374a3 100644
--- a/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCFrameRateControllerTest.cpp
@@ -139,4 +139,37 @@ TEST(CCFrameRateControllerTest, TestFrameThrottling_TwoFramesInFlight)
     EXPECT_TRUE(client.vsyncTicked());
 }
 
+TEST(CCFrameRateControllerTest, TestFrameThrottling_Unthrottled)
+{
+    FakeCCThread thread;
+    FakeCCFrameRateControllerClient client;
+    CCFrameRateController controller(&thread);
+
+    controller.setClient(&client);
+    controller.setMaxFramesPending(2);
+
+    // setActive triggers 1st frame, make sure the vsync callback is called
+    controller.setActive(true);
+    thread.runPendingTask();
+    EXPECT_TRUE(client.vsyncTicked());
+    client.reset();
+
+    // didBeginFrame triggers 2nd frame, make sure the vsync callback is called
+    controller.didBeginFrame();
+    thread.runPendingTask();
+    EXPECT_TRUE(client.vsyncTicked());
+    client.reset();
+
+    // didBeginFrame triggers 3rd frame (> maxFramesPending), make sure the vsync callback is NOT called
+    controller.didBeginFrame();
+    thread.runPendingTask();
+    EXPECT_FALSE(client.vsyncTicked());
+    client.reset();
+
+    // didFinishFrame triggers a frame, make sure the vsync callback is called
+    controller.didFinishFrame();
+    thread.runPendingTask();
+    EXPECT_TRUE(client.vsyncTicked());
+}
+
 }
diff --git a/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
index eb6bb0363..4d2c4ddaf 100644
--- a/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
+++ b/Source/WebKit/chromium/tests/CCKeyframedAnimationCurveTest.cpp
@@ -26,9 +26,6 @@
 
 #include "cc/CCKeyframedAnimationCurve.h"
 
-#include "Length.h"
-#include "TranslateTransformOperation.h"
-
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <public/WebTransformOperations.h>
diff --git a/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp b/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
index 72361092a..2ce33a561 100644
--- a/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerAnimationControllerTest.cpp
@@ -27,8 +27,6 @@
 #include "cc/CCLayerAnimationController.h"
 
 #include "CCAnimationTestCommon.h"
-#include "GraphicsLayer.h"
-#include "Length.h"
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCAnimationCurve.h"
 
diff --git a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
index 47edeec9d..27c4a918a 100644
--- a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
@@ -103,6 +103,17 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     WebFilterOperations arbitraryFilters;
     arbitraryFilters.append(WebFilterOperation::createOpacityFilter(0.5));
 
+    // These properties are internal, and should not be considered "change" when they are used.
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setUseLCDText(true));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawOpacity(arbitraryNumber));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setRenderTarget(0));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawTransform(arbitraryTransform));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScreenSpaceTransform(arbitraryTransform));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawableContentRect(arbitraryIntRect));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setUpdateRect(arbitraryFloatRect));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setVisibleContentRect(arbitraryIntRect));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setMaxScrollPosition(arbitraryIntSize));
+
     // Changing these properties affects the entire subtree of layers.
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPoint(arbitraryFloatPoint));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setAnchorPointZ(arbitraryNumber));
@@ -115,7 +126,7 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setPreserves3D(true));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setDoubleSided(false)); // constructor initializes it to "true".
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->scrollBy(arbitraryIntSize));
-    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setScrollDelta(arbitraryIntSize));
+    EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setScrollDelta(IntSize()));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setScrollPosition(arbitraryIntPoint));
     EXECUTE_AND_VERIFY_SUBTREE_CHANGED(root->setPageScaleDelta(arbitraryNumber));
 
@@ -153,7 +164,7 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setPreserves3D(true));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setTransform(arbitraryTransform));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDoubleSided(false)); // constructor initializes it to "true".
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScrollDelta(arbitraryIntSize));
+    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScrollDelta(IntSize()));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScrollPosition(arbitraryIntPoint));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setPageScaleDelta(arbitraryNumber));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setContentBounds(arbitraryIntSize));
@@ -164,17 +175,6 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawsContent(true));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setSublayerTransform(arbitraryTransform));
     EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setBounds(arbitraryIntSize));
-
-    // These properties are internal, and should not be considered "change" when they are used.
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setIsNonCompositedContent(true));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawOpacity(arbitraryNumber));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setRenderTarget(0));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawTransform(arbitraryTransform));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setScreenSpaceTransform(arbitraryTransform));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setDrawableContentRect(arbitraryIntRect));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setUpdateRect(arbitraryFloatRect));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setVisibleContentRect(arbitraryIntRect));
-    EXECUTE_AND_VERIFY_SUBTREE_DID_NOT_CHANGE(root->setMaxScrollPosition(arbitraryIntSize));
 }
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
index 73fda4cb4..b5e226916 100644
--- a/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerIteratorTest.cpp
@@ -148,7 +148,7 @@ TEST(CCLayerIteratorTest, simpleTree)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer.get(), rootLayer->bounds(), 1, 256, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     iterateBackToFront(&renderSurfaceLayerList);
     EXPECT_COUNT(rootLayer, 0, -1, 1);
@@ -191,7 +191,7 @@ TEST(CCLayerIteratorTest, complexTree)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer.get(), rootLayer->bounds(), 1, 256, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     iterateBackToFront(&renderSurfaceLayerList);
     EXPECT_COUNT(rootLayer, 0, -1, 1);
@@ -247,7 +247,7 @@ TEST(CCLayerIteratorTest, complexTreeMultiSurface)
 
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer.get(), rootLayer->bounds(), 1, 256, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     iterateBackToFront(&renderSurfaceLayerList);
     EXPECT_COUNT(rootLayer, 0, -1, 1);
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index 9e249f2d7..9fd226858 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -30,7 +30,6 @@
 #include "CCLayerTreeTestCommon.h"
 #include "ContentLayerChromium.h"
 #include "LayerChromium.h"
-#include "TranslateTransformOperation.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerSorter.h"
@@ -80,7 +79,7 @@ void executeCalculateDrawTransformsAndVisibility(LayerChromium* rootLayer)
     // We are probably not testing what is intended if the rootLayer bounds are empty.
     ASSERT(!rootLayer->bounds().isEmpty());
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer, rootLayer->bounds(), 1, dummyMaxTextureSize, dummyRenderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(dummyRenderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(dummyRenderSurfaceLayerList);
 }
 
 void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* rootLayer)
@@ -94,7 +93,7 @@ void executeCalculateDrawTransformsAndVisibility(CCLayerImpl* rootLayer)
     // We are probably not testing what is intended if the rootLayer bounds are empty.
     ASSERT(!rootLayer->bounds().isEmpty());
     CCLayerTreeHostCommon::calculateDrawTransforms(rootLayer, rootLayer->bounds(), 1, 0, dummyMaxTextureSize, dummyRenderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(dummyRenderSurfaceLayerList, rootLayer->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(dummyRenderSurfaceLayerList);
 }
 
 WebTransformationMatrix remove3DComponentOfMatrix(const WebTransformationMatrix& mat)
@@ -359,344 +358,6 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForSingleRenderSurface)
     EXPECT_TRANSFORMATION_MATRIX_EQ(parentCompositeTransform, child->renderTarget()->renderSurface()->screenSpaceTransform());
 }
 
-TEST(CCLayerTreeHostCommonTest, scissorRectWithClip)
-{
-    DebugScopedSetImplThread thisScopeIsOnImplThread;
-
-    /*
-      Layers are created as follows:
-
-         +--------------------+
-         |                  1 |
-         |  +-----------+     |
-         |  |         2 |     |
-         |  | +-------------------+
-         |  | |   3               |
-         |  | +-------------------+
-         |  |           |     |
-         |  +-----------+     |
-         |                    |
-         |                    |
-         +--------------------+
-
-         Layers 1, 2 have render surfaces
-     */
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    OwnPtr<CCLayerImpl> child = CCLayerImpl::create(2);
-    OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
-
-    IntRect rootRect(0, 0, 100, 100);
-    IntRect childRect(10, 10, 50, 50);
-    IntRect grandChildRect(5, 5, 150, 150);
-
-    root->setAnchorPoint(FloatPoint(0, 0));
-    root->setPosition(FloatPoint(rootRect.x(), rootRect.y()));
-    root->setBounds(IntSize(rootRect.width(), rootRect.height()));
-    root->setContentBounds(root->bounds());
-    root->setDrawsContent(true);
-
-    child->setAnchorPoint(FloatPoint(0, 0));
-    child->setPosition(FloatPoint(childRect.x(), childRect.y()));
-    child->setOpacity(0.5);
-    child->setBounds(IntSize(childRect.width(), childRect.height()));
-    child->setContentBounds(child->bounds());
-    child->setDrawsContent(true);
-
-    grandChild->setAnchorPoint(FloatPoint(0, 0));
-    grandChild->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
-    grandChild->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
-    grandChild->setContentBounds(grandChild->bounds());
-    grandChild->setDrawsContent(true);
-
-    CCLayerImpl* childPtr = child.get();
-    CCLayerImpl* grandChildPtr = grandChild.get();
-
-    child->addChild(grandChild.release());
-    root->addChild(child.release());
-
-    root->setMasksToBounds(true);
-
-    Vector<CCLayerImpl*> renderSurfaceLayerList;
-    {
-        int dummyMaxTextureSize = 512;
-        CCLayerSorter layerSorter;
-        CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, &layerSorter, dummyMaxTextureSize, renderSurfaceLayerList);
-
-        FloatRect dummyDamageRect;
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, dummyDamageRect);
-    }
-    
-    ASSERT_TRUE(childPtr->renderSurface());
-    ASSERT_TRUE(root->renderSurface());
-    ASSERT_FALSE(grandChildPtr->renderSurface());
-    
-    EXPECT_EQ(renderSurfaceLayerList.size(), 2U);
-    
-    ASSERT_EQ(root->renderSurface()->clipRect(), rootRect);
-    // Child surface's clipping rect is now set to root's
-    ASSERT_EQ(childPtr->renderSurface()->clipRect(), rootRect);
-    
-    // Damage the entire screen
-    IntRect rootDamage(rootRect);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    // Child's renderSurface would have expanded to include the 150x150 grandChild located at (5, 5), and then have been clipped by the parent.
-    IntRect expectedChildRenderSurfaceScissor = intersection(rootRect, IntRect(10, 10, 155, 155));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), expectedChildRenderSurfaceScissor);
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(rootRect));
-
-    // The child layer is not clipped by anything (that clip is already represented by the rootSurface clipping the child's surface)
-    // So here, the expected scissor is just the child layer's rect expressed in targetSurface (child surface) space.
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, childRect.width(), childRect.height()));
-
-    // Grand child is (indirectly) clipped by the root surface. But the scissor is expressed in the targetSurface (child surface) space.
-    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 85, 85));
-    
-    // Empty damage
-    rootDamage = IntRect(0, 0, 0, 0);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Empty damage == empty scissor
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    // Partial damage within child
-    rootDamage = IntRect(10, 10, 20, 20);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Grand child scissor is the damage intersected with the clipped grandChild layer rect (expressed in targetSurface space).
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 15, 15));
-
-    // Partial damage beyond child
-    rootDamage = IntRect(10, 10, 80, 80);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Child layer overlaps a portion of the damage rect.
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-
-    // Grand child scissor is the intersection of damage and grandChild rect, expressed in child surface.
-    // The damage fits entirely within the grandChild.
-    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 75, 75));
-
-    // Partial damage beyond root
-    rootDamage = IntRect(10, 10, 110, 110);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Root damage rect is clipped at root layer boundary.
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-    EXPECT_EQ(root->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-
-    // Now the scissor rects are clipped by surfaces contentRect
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-    EXPECT_INT_RECT_EQ(grandChildPtr->scissorRect(), IntRect(5, 5, 105, 105));
-}
-
-TEST(CCLayerTreeHostCommonTest, scissorRectWithClipAndSpaceTransform)
-{
-    DebugScopedSetImplThread thisScopeIsOnImplThread;
-
-    /*
-      Layers are created as follows:
-
-         +--------------------+
-         |                  1 |
-         |  +-----------+     |
-         |  |         2 |     |
-         |  | +-------------------+
-         |  | |   3,4             |
-         |  | +-------------------+
-         |  |           |     |
-         |  +-----------+     |
-         |                    |
-         |                    |
-         +--------------------+
-
-         Layers 1, 2 and 3 have render surfaces
-     */
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
-    OwnPtr<CCLayerImpl> child = CCLayerImpl::create(2);
-    OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
-    OwnPtr<CCLayerImpl> grandChild2 = CCLayerImpl::create(4);
-
-    IntRect rootRect(0, 0, 100, 100);
-    IntRect childRect(10, 10, 50, 50);
-    IntRect grandChildRect(5, 5, 150, 150);
-
-    root->setAnchorPoint(FloatPoint(0, 0));
-    root->setPosition(FloatPoint(rootRect.x(), rootRect.y()));
-    root->setBounds(IntSize(rootRect.width(), rootRect.height()));
-    root->setContentBounds(root->bounds());
-    root->setDrawsContent(true);
-
-    child->setAnchorPoint(FloatPoint(0, 0));
-    child->setPosition(FloatPoint(childRect.x(), childRect.y()));
-    child->setOpacity(0.5);
-    child->setBounds(IntSize(childRect.width(), childRect.height()));
-    child->setContentBounds(child->bounds());
-    child->setDrawsContent(true);
-
-    grandChild->setAnchorPoint(FloatPoint(0, 0));
-    grandChild->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
-    grandChild->setOpacity(0.5);
-    grandChild->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
-    grandChild->setContentBounds(grandChild->bounds());
-    grandChild->setDrawsContent(true);
-
-    grandChild2->setAnchorPoint(FloatPoint(0, 0));
-    grandChild2->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
-    grandChild2->setOpacity(0.5);
-    grandChild2->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
-    grandChild2->setContentBounds(grandChild2->bounds());
-    grandChild2->setDrawsContent(true);
-
-    CCLayerImpl* childPtr = child.get();
-    CCLayerImpl* grandChildPtr = grandChild.get();
-
-    grandChild->addChild(grandChild2.release());
-    child->addChild(grandChild.release());
-    root->addChild(child.release());
-
-    root->setMasksToBounds(true);
-
-    Vector<CCLayerImpl*> renderSurfaceLayerList;
-    {
-        int dummyMaxTextureSize = 512;
-        CCLayerSorter layerSorter;
-        CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, &layerSorter, dummyMaxTextureSize, renderSurfaceLayerList);
-
-        FloatRect dummyDamageRect;
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, dummyDamageRect);
-    }
-    
-    ASSERT_TRUE(childPtr->renderSurface());
-    ASSERT_TRUE(root->renderSurface());
-    ASSERT_TRUE(grandChildPtr->renderSurface());
-    
-    EXPECT_EQ(renderSurfaceLayerList.size(), 3U);
-    
-    EXPECT_INT_RECT_EQ(root->renderSurface()->clipRect(), rootRect);
-    // Child surface's clipping rect is now set to root's
-    EXPECT_INT_RECT_EQ(childPtr->renderSurface()->clipRect(), rootRect);
-    
-    // Damage the entire screen
-    IntRect rootDamage(rootRect);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    ASSERT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    // Child's renderSurface would have expanded to include the grandChild1 and grandChild2, and then have been clipped by the parent.
-    IntRect expectedChildRenderSurfaceScissor = intersection(rootRect, IntRect(10, 10, 160, 160));
-    ASSERT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), expectedChildRenderSurfaceScissor);
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(rootRect));
-
-    // The child layer is not clipped by anything (that clip is already represented by the rootSurface clipping the child's surface)
-    // So here, the expected scissor is just the child layer's rect expressed in targetSurface (child surface) space.
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, childRect.width(), childRect.height()));
-
-    // Grand child now draws to its own render surface, so the scissorRect is in that surface's space.
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, rootRect.width() - childRect.x() - grandChildRect.x(), rootRect.height() - childRect.y() - grandChildRect.y()));
-    
-    // Empty damage
-    rootDamage = IntRect(0, 0, 0, 0);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Empty damage == empty scissor
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    EXPECT_EQ(root->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(0, 0, 0, 0));
-    
-    // Partial damage within child
-    rootDamage = IntRect(10, 10, 20, 20);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but with different offset
-    EXPECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width(), rootDamage.height()));
-
-    // Grand child now gets scissored by its target surface as well as root
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
-
-    // Partial damage beyond child
-    rootDamage = IntRect(10, 10, 80, 80);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Entire damage rect is within the root surface
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), rootDamage);
-    
-    // Entire damage rect is within the layer
-    EXPECT_EQ(root->scissorRect(), rootDamage);
-
-    // Entire damage rect is within the layer, but it is still clipped with respect to the root.
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-
-    // Grand child now gets scissored by its target surface as well as root
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
-
-    // Partial damage beyond root
-    rootDamage = IntRect(10, 10, 110, 110);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, rootDamage);
-    
-    // Scissors are not computed for root
-    EXPECT_EQ(root->renderTarget()->renderSurface()->scissorRect(), IntRect(0, 0, 0, 0));
-
-    // Root surface does not have a clipRect, so its contentRect will be used to intersect with damage.
-    // Result is that root damage rect is clipped at root layer boundary
-    EXPECT_EQ(childPtr->renderTarget()->renderSurface()->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-    
-    // Root does not use layer clipping, so its content rect will be used to intersect with damage
-    // Result is that root damage rect is clipped at root layer boundary
-    EXPECT_EQ(root->scissorRect(), IntRect(rootDamage.x(), rootDamage.y(), rootRect.width() - rootDamage.x(), rootRect.height() - rootDamage.y()));
-
-    EXPECT_INT_RECT_EQ(childPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), childRect.width(), childRect.height()));
-
-    // Grandchild's scissor rect is clipped by its target surface
-    EXPECT_EQ(grandChildPtr->scissorRect(), IntRect(rootDamage.x() - childRect.x(), rootDamage.y() - childRect.y(), rootDamage.width() - grandChildRect.x(), rootDamage.height() - grandChildRect.y()));
-}
-
 TEST(CCLayerTreeHostCommonTest, verifyTransformsForReplica)
 {
     RefPtr<LayerChromium> parent = LayerChromium::create();
@@ -903,6 +564,51 @@ TEST(CCLayerTreeHostCommonTest, verifyTransformsForRenderSurfaceHierarchy)
     EXPECT_FLOAT_EQ(5, grandChildOfRS2->screenSpaceTransform().m42());
 }
 
+TEST(CCLayerTreeHostCommonTest, verifyTransformsForFlatteningLayer)
+{
+    // For layers that flatten their subtree, there should be an orthographic projection
+    // (for x and y values) in the middle of the transform sequence. Note that the way the
+    // code is currently implemented, it is not expected to use a canonical orthographic
+    // projection.
+
+    RefPtr<LayerChromium> root = LayerChromium::create();
+    RefPtr<LayerChromium> child = LayerChromium::create();
+    RefPtr<LayerChromiumWithForcedDrawsContent> grandChild = adoptRef(new LayerChromiumWithForcedDrawsContent());
+
+    WebTransformationMatrix rotationAboutYAxis;
+    rotationAboutYAxis.rotate3d(0, 30, 0);
+
+    const WebTransformationMatrix identityMatrix;
+    setLayerPropertiesForTesting(root.get(), identityMatrix, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(100, 100), false);
+    setLayerPropertiesForTesting(child.get(), rotationAboutYAxis, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
+    setLayerPropertiesForTesting(grandChild.get(), rotationAboutYAxis, identityMatrix, FloatPoint::zero(), FloatPoint::zero(), IntSize(10, 10), false);
+
+    root->addChild(child);
+    child->addChild(grandChild);
+    child->setForceRenderSurface(true);
+
+    // No layers in this test should preserve 3d.
+    ASSERT_FALSE(root->preserves3D());
+    ASSERT_FALSE(child->preserves3D());
+    ASSERT_FALSE(grandChild->preserves3D());
+
+    WebTransformationMatrix expectedChildDrawTransform = rotationAboutYAxis;
+    WebTransformationMatrix expectedChildScreenSpaceTransform = rotationAboutYAxis;
+    WebTransformationMatrix expectedGrandChildDrawTransform = rotationAboutYAxis; // draws onto child's renderSurface
+    WebTransformationMatrix expectedGrandChildScreenSpaceTransform = rotationAboutYAxis.to2dTransform() * rotationAboutYAxis;
+
+    executeCalculateDrawTransformsAndVisibility(root.get());
+
+    // The child's drawTransform should have been taken by its surface.
+    ASSERT_TRUE(child->renderSurface());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildDrawTransform, child->renderSurface()->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildScreenSpaceTransform, child->renderSurface()->screenSpaceTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(identityMatrix, child->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedChildScreenSpaceTransform, child->screenSpaceTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedGrandChildDrawTransform, grandChild->drawTransform());
+    EXPECT_TRANSFORMATION_MATRIX_EQ(expectedGrandChildScreenSpaceTransform, grandChild->screenSpaceTransform());
+}
+
 TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceListForRenderSurfaceWithClippedLayer)
 {
     RefPtr<LayerChromium> parent = LayerChromium::create();
@@ -921,7 +627,7 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceListForRenderSurfaceWithClipp
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // The child layer's content is entirely outside the parent's clip rect, so the intermediate
     // render surface should not be listed here, even if it was forced to be created. Render surfaces without children or visible
@@ -949,7 +655,7 @@ TEST(CCLayerTreeHostCommonTest, verifyRenderSurfaceListForTransparentChild)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Since the layer is transparent, renderSurface1->renderSurface() should not have gotten added anywhere.
     // Also, the drawable content rect should not have been extended by the children.
@@ -1605,7 +1311,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectCullsRenderSurfaces)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
 
     ASSERT_EQ(2U, renderSurfaceLayerList.size());
@@ -1718,9 +1424,7 @@ TEST(CCLayerTreeHostCommonTest, verifyDrawableContentRectForLayers)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
-
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     EXPECT_INT_RECT_EQ(IntRect(IntPoint(5, 5), IntSize(10, 10)), grandChild1->drawableContentRect());
     EXPECT_INT_RECT_EQ(IntRect(IntPoint(15, 15), IntSize(5, 5)), grandChild3->drawableContentRect());
@@ -1786,8 +1490,7 @@ TEST(CCLayerTreeHostCommonTest, verifyClipRectIsPropagatedCorrectlyToSurfaces)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     ASSERT_TRUE(grandChild1->renderSurface());
     ASSERT_TRUE(grandChild2->renderSurface());
@@ -2438,8 +2141,7 @@ TEST(CCLayerTreeHostCommonTest, verifyBackFaceCullingWithAnimatingTransforms)
     Vector<RefPtr<LayerChromium> > renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(parent.get(), parent->bounds(), 1, dummyMaxTextureSize, renderSurfaceLayerList);
-
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, parent->renderSurface()->contentRect());
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     EXPECT_FALSE(child->renderSurface());
     EXPECT_TRUE(animatingSurface->renderSurface());
@@ -2560,7 +2262,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSingleLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2610,7 +2312,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForUninvertibleTransform)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2665,7 +2367,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSinglePositionedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2713,7 +2415,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSingleRotatedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2770,7 +2472,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSinglePerspectiveLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2835,7 +2537,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSingleLayerWithScaledContents
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     // The visibleContentRect for testLayer is actually 100x100, even though its layout size is 50x50, positioned at 25x25.
@@ -2900,7 +2602,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForSimpleClippedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_EQ(1u, renderSurfaceLayerList.size());
@@ -2991,7 +2693,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultiClippedRotatedLayer)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     // The grandChild is expected to create a renderSurface because it masksToBounds and is not axis aligned.
@@ -3039,6 +2741,70 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultiClippedRotatedLayer)
     EXPECT_EQ(2468, resultLayer->id());
 }
 
+TEST(CCLayerTreeHostCommonTest, verifyHitTestingForNonClippingIntermediateLayer)
+{
+    // This test checks that hit testing code does not accidentally clip to layer
+    // bounds for a layer that actually does not clip.
+    DebugScopedSetImplThread thisScopeIsOnImplThread;
+
+    WebTransformationMatrix identityMatrix;
+    FloatPoint anchor(0, 0);
+
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    setLayerPropertiesForTesting(root.get(), identityMatrix, identityMatrix, anchor, FloatPoint(0, 0), IntSize(100, 100), false);
+
+    {
+        OwnPtr<CCLayerImpl> intermediateLayer = CCLayerImpl::create(123);
+        FloatPoint position(10, 10); // this layer is positioned, and hit testing should correctly know where the layer is located.
+        IntSize bounds(50, 50);
+        setLayerPropertiesForTesting(intermediateLayer.get(), identityMatrix, identityMatrix, anchor, position, bounds, false);
+        // Sanity check the intermediate layer should not clip.
+        ASSERT_FALSE(intermediateLayer->masksToBounds());
+        ASSERT_FALSE(intermediateLayer->maskLayer());
+
+        // The child of the intermediateLayer is translated so that it does not overlap intermediateLayer at all.
+        // If child is incorrectly clipped, we would not be able to hit it successfully.
+        OwnPtr<CCLayerImpl> child = CCLayerImpl::create(456);
+        position = FloatPoint(60, 60); // 70, 70 in screen space
+        bounds = IntSize(20, 20);
+        setLayerPropertiesForTesting(child.get(), identityMatrix, identityMatrix, anchor, position, bounds, false);
+        child->setDrawsContent(true);
+        intermediateLayer->addChild(child.release());
+        root->addChild(intermediateLayer.release());
+    }
+
+    Vector<CCLayerImpl*> renderSurfaceLayerList;
+    int dummyMaxTextureSize = 512;
+    CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
+
+    // Sanity check the scenario we just created.
+    ASSERT_EQ(1u, renderSurfaceLayerList.size());
+    ASSERT_EQ(1u, root->renderSurface()->layerList().size());
+    ASSERT_EQ(456, root->renderSurface()->layerList()[0]->id());
+
+    // Hit testing for a point outside the layer should return a null pointer.
+    IntPoint testPoint(69, 69);
+    CCLayerImpl* resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    EXPECT_FALSE(resultLayer);
+
+    testPoint = IntPoint(91, 91);
+    resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    EXPECT_FALSE(resultLayer);
+
+    // Hit testing for a point inside should return the child layer.
+    testPoint = IntPoint(71, 71);
+    resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    ASSERT_TRUE(resultLayer);
+    EXPECT_EQ(456, resultLayer->id());
+
+    testPoint = IntPoint(89, 89);
+    resultLayer = CCLayerTreeHostCommon::findLayerThatIsHitByPoint(testPoint, renderSurfaceLayerList);
+    ASSERT_TRUE(resultLayer);
+    EXPECT_EQ(456, resultLayer->id());
+}
+
+
 TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultipleLayers)
 {
     DebugScopedSetImplThread thisScopeIsOnImplThread;
@@ -3091,7 +2857,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultipleLayers)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_TRUE(child1);
@@ -3200,7 +2966,7 @@ TEST(CCLayerTreeHostCommonTest, verifyHitTestingForMultipleLayerLists)
     Vector<CCLayerImpl*> renderSurfaceLayerList;
     int dummyMaxTextureSize = 512;
     CCLayerTreeHostCommon::calculateDrawTransforms(root.get(), root->bounds(), 1, 0, dummyMaxTextureSize, renderSurfaceLayerList);
-    CCLayerTreeHostCommon::calculateVisibleAndScissorRects(renderSurfaceLayerList, FloatRect()); // empty scissorRect will help ensure we're hit testing the correct rect.
+    CCLayerTreeHostCommon::calculateVisibleRects(renderSurfaceLayerList);
 
     // Sanity check the scenario we just created.
     ASSERT_TRUE(child1);
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
index 53c312cf5..2c14a1cc3 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
@@ -30,8 +30,11 @@
 #include "CCLayerTestCommon.h"
 #include "CCLayerTreeTestCommon.h"
 #include "CCTestCommon.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
+#include "FakeWebScrollbarThemeGeometry.h"
 #include "LayerRendererChromium.h"
+#include "cc/CCHeadsUpDisplayLayerImpl.h"
 #include "cc/CCIOSurfaceLayerImpl.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTilingData.h"
@@ -74,11 +77,12 @@ public:
 
         m_hostImpl = CCLayerTreeHostImpl::create(settings, this);
         m_hostImpl->initializeLayerRenderer(createContext(), UnthrottledUploader);
-        m_hostImpl->setViewportSize(IntSize(10, 10));
+        m_hostImpl->setViewportSize(IntSize(10, 10), IntSize(10, 10));
     }
 
     virtual void didLoseContextOnImplThread() OVERRIDE { }
     virtual void onSwapBuffersCompleteOnImplThread() OVERRIDE { }
+    virtual void onVSyncParametersChanged(double, double) OVERRIDE { }
     virtual void setNeedsRedrawOnImplThread() OVERRIDE { m_didRequestRedraw = true; }
     virtual void setNeedsCommitOnImplThread() OVERRIDE { m_didRequestCommit = true; }
     virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) OVERRIDE { }
@@ -93,7 +97,7 @@ public:
         OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
         myHostImpl->initializeLayerRenderer(graphicsContext, UnthrottledUploader);
-        myHostImpl->setViewportSize(IntSize(10, 10));
+        myHostImpl->setViewportSize(IntSize(10, 10), IntSize(10, 10));
 
         OwnPtr<CCLayerImpl> root = rootPtr;
 
@@ -174,7 +178,7 @@ public:
 protected:
     PassOwnPtr<CCGraphicsContext> createContext()
     {
-        return CCGraphicsContext::create3D(adoptPtr(new FakeWebGraphicsContext3D));
+        return FakeWebCompositorOutputSurface::create(adoptPtr(new FakeWebGraphicsContext3D));
     }
 
     DebugScopedSetImplThread m_alwaysImplThread;
@@ -256,7 +260,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollDeltaRepeatedScrolls)
 TEST_F(CCLayerTreeHostImplTest, scrollRootCallsCommitAndRedraw)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(0, 0), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
@@ -277,7 +281,7 @@ TEST_F(CCLayerTreeHostImplTest, replaceTreeWhileScrolling)
     const int scrollLayerId = 1;
 
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     // We should not crash if the tree is replaced while we are scrolling.
@@ -297,7 +301,7 @@ TEST_F(CCLayerTreeHostImplTest, replaceTreeWhileScrolling)
 TEST_F(CCLayerTreeHostImplTest, clearRootRenderSurfaceAndScroll)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     // We should be able to scroll even if the root layer loses its render surface after the most
@@ -309,7 +313,7 @@ TEST_F(CCLayerTreeHostImplTest, clearRootRenderSurfaceAndScroll)
 TEST_F(CCLayerTreeHostImplTest, wheelEventHandlers)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
@@ -325,7 +329,7 @@ TEST_F(CCLayerTreeHostImplTest, wheelEventHandlers)
 TEST_F(CCLayerTreeHostImplTest, shouldScrollOnMainThread)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
@@ -338,7 +342,7 @@ TEST_F(CCLayerTreeHostImplTest, shouldScrollOnMainThread)
 TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionBasic)
 {
     setupScrollAndContentsLayers(IntSize(200, 200));
-    m_hostImpl->setViewportSize(IntSize(100, 100));
+    m_hostImpl->setViewportSize(IntSize(100, 100), IntSize(100, 100));
     initializeLayerRendererAndDrawFrame();
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
@@ -360,7 +364,7 @@ TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionBasic)
 TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionWithOffset)
 {
     setupScrollAndContentsLayers(IntSize(200, 200));
-    m_hostImpl->setViewportSize(IntSize(100, 100));
+    m_hostImpl->setViewportSize(IntSize(100, 100), IntSize(100, 100));
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
     root->setNonFastScrollableRegion(IntRect(0, 0, 50, 50));
@@ -379,7 +383,7 @@ TEST_F(CCLayerTreeHostImplTest, nonFastScrollableRegionWithOffset)
 TEST_F(CCLayerTreeHostImplTest, pinchGesture)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -460,7 +464,7 @@ TEST_F(CCLayerTreeHostImplTest, pinchGesture)
 TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -510,7 +514,7 @@ TEST_F(CCLayerTreeHostImplTest, pageScaleAnimation)
 TEST_F(CCLayerTreeHostImplTest, inhibitScrollAndPageScaleUpdatesWhilePinchZooming)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -564,7 +568,7 @@ TEST_F(CCLayerTreeHostImplTest, inhibitScrollAndPageScaleUpdatesWhilePinchZoomin
 TEST_F(CCLayerTreeHostImplTest, inhibitScrollAndPageScaleUpdatesWhileAnimatingPageScale)
 {
     setupScrollAndContentsLayers(IntSize(100, 100));
-    m_hostImpl->setViewportSize(IntSize(50, 50));
+    m_hostImpl->setViewportSize(IntSize(50, 50), IntSize(50, 50));
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* scrollLayer = m_hostImpl->rootScrollLayer();
@@ -696,7 +700,7 @@ TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnHiddenLayer)
 TEST_F(CCLayerTreeHostImplTest, willDrawNotCalledOnOccludedLayer)
 {
     IntSize bigSize(1000, 1000);
-    m_hostImpl->setViewportSize(bigSize);
+    m_hostImpl->setViewportSize(bigSize, bigSize);
 
     m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
@@ -841,7 +845,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollNonCompositedRoot)
     IntSize surfaceSize(10, 10);
 
     OwnPtr<CCLayerImpl> contentLayer = CCLayerImpl::create(1);
-    contentLayer->setIsNonCompositedContent(true);
+    contentLayer->setUseLCDText(true);
     contentLayer->setDrawsContent(true);
     contentLayer->setPosition(FloatPoint(0, 0));
     contentLayer->setAnchorPoint(FloatPoint(0, 0));
@@ -858,7 +862,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollNonCompositedRoot)
     scrollLayer->addChild(contentLayer.release());
 
     m_hostImpl->setRootLayer(scrollLayer.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(5, 5), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
@@ -876,7 +880,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildCallsCommitAndRedraw)
     root->setContentBounds(surfaceSize);
     root->addChild(createScrollableLayer(2, FloatPoint(0, 0), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(5, 5), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
@@ -892,7 +896,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollMissesChild)
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     root->addChild(createScrollableLayer(2, FloatPoint(0, 0), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     // Scroll event is ignored because the input coordinate is outside the layer boundaries.
@@ -906,7 +910,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollMissesBackfacingChild)
     IntSize surfaceSize(10, 10);
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     OwnPtr<CCLayerImpl> child = createScrollableLayer(2, FloatPoint(0, 0), surfaceSize);
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
 
     WebTransformationMatrix matrix;
     matrix.rotate3d(180, 0, 0);
@@ -935,7 +939,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollBlockedByContentLayer)
     scrollLayer->addChild(contentLayer.release());
 
     m_hostImpl->setRootLayer(scrollLayer.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     // Scrolling fails because the content layer is asking to be scrolled on the main thread.
@@ -948,7 +952,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnMainThread)
     float pageScale = 2;
     OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(0, 0), surfaceSize);
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     IntSize scrollDelta(0, 10);
@@ -979,7 +983,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnImplThread)
     float pageScale = 2;
     OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(0, 0), surfaceSize);
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     m_hostImpl->setPageScaleFactorAndLimits(1, 1, pageScale);
     initializeLayerRendererAndDrawFrame();
 
@@ -1057,7 +1061,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildAndChangePageScaleOnMainThread)
     int scrollLayerId = 2;
     root->addChild(createScrollableLayer(scrollLayerId, FloatPoint(0, 0), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
 
     CCLayerImpl* child = m_hostImpl->rootLayer()->children()[0].get();
@@ -1101,7 +1105,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildBeyondLimit)
 
     root->addChild(child.release());
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
     {
         IntSize scrollDelta(-3, -7);
@@ -1133,7 +1137,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollEventBubbling)
     root->addChild(child.release());
 
     m_hostImpl->setRootLayer(root.release());
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
     initializeLayerRendererAndDrawFrame();
     {
         IntSize scrollDelta(0, 4);
@@ -1153,7 +1157,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollBeforeRedraw)
 {
     IntSize surfaceSize(10, 10);
     m_hostImpl->setRootLayer(createScrollableLayer(1, FloatPoint(0, 0), surfaceSize));
-    m_hostImpl->setViewportSize(surfaceSize);
+    m_hostImpl->setViewportSize(surfaceSize, surfaceSize);
 
     // Draw one frame and then immediately rebuild the layer tree to mimic a tree synchronization.
     initializeLayerRendererAndDrawFrame();
@@ -1471,7 +1475,7 @@ TEST_F(CCLayerTreeHostImplTest, viewportCovered)
     m_hostImpl->setBackgroundColor(SK_ColorGRAY);
 
     IntSize viewportSize(1000, 1000);
-    m_hostImpl->setViewportSize(viewportSize);
+    m_hostImpl->setViewportSize(viewportSize, viewportSize);
 
     m_hostImpl->setRootLayer(BlendStateCheckLayer::create(1, m_hostImpl->resourceProvider()));
     BlendStateCheckLayer* root = static_cast<BlendStateCheckLayer*>(m_hostImpl->rootLayer());
@@ -1576,7 +1580,7 @@ public:
 // viewport size is never set.
 TEST_F(CCLayerTreeHostImplTest, reshapeNotCalledUntilDraw)
 {
-    OwnPtr<CCGraphicsContext> ccContext = CCGraphicsContext::create3D(adoptPtr(new ReshapeTrackerContext));
+    OwnPtr<CCGraphicsContext> ccContext = FakeWebCompositorOutputSurface::create(adoptPtr(new ReshapeTrackerContext));
     ReshapeTrackerContext* reshapeTracker = static_cast<ReshapeTrackerContext*>(ccContext->context3D());
     m_hostImpl->initializeLayerRenderer(ccContext.release(), UnthrottledUploader);
 
@@ -1619,7 +1623,7 @@ private:
 // where it should request to swap only the subBuffer that is damaged.
 TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
 {
-    OwnPtr<CCGraphicsContext> ccContext = CCGraphicsContext::create3D(adoptPtr(new PartialSwapTrackerContext));
+    OwnPtr<CCGraphicsContext> ccContext = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapTrackerContext));
     PartialSwapTrackerContext* partialSwapTracker = static_cast<PartialSwapTrackerContext*>(ccContext->context3D());
 
     // This test creates its own CCLayerTreeHostImpl, so
@@ -1628,7 +1632,7 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
     CCSettings::setPartialSwapEnabled(true);
     OwnPtr<CCLayerTreeHostImpl> layerTreeHostImpl = CCLayerTreeHostImpl::create(settings, this);
     layerTreeHostImpl->initializeLayerRenderer(ccContext.release(), UnthrottledUploader);
-    layerTreeHostImpl->setViewportSize(IntSize(500, 500));
+    layerTreeHostImpl->setViewportSize(IntSize(500, 500), IntSize(500, 500));
 
     CCLayerImpl* root = new FakeDrawableCCLayerImpl(1);
     CCLayerImpl* child = new FakeDrawableCCLayerImpl(2);
@@ -1677,7 +1681,7 @@ TEST_F(CCLayerTreeHostImplTest, partialSwapReceivesDamageRect)
     // Make sure that partial swap is constrained to the viewport dimensions
     // expected damage rect: IntRect(IntPoint::zero(), IntSize(500, 500));
     // expected swap rect: flipped damage rect, but also clamped to viewport
-    layerTreeHostImpl->setViewportSize(IntSize(10, 10));
+    layerTreeHostImpl->setViewportSize(IntSize(10, 10), IntSize(10, 10));
     root->setOpacity(0.7f); // this will damage everything
     EXPECT_TRUE(layerTreeHostImpl->prepareToDraw(frame));
     layerTreeHostImpl->drawLayers(frame);
@@ -1748,6 +1752,7 @@ public:
     MOCK_METHOD1(getString, WebString(WGC3Denum name));
     MOCK_METHOD0(getRequestableExtensionsCHROMIUM, WebString());
     MOCK_METHOD1(enable, void(WGC3Denum cap));
+    MOCK_METHOD1(disable, void(WGC3Denum cap));
     MOCK_METHOD4(scissor, void(WGC3Dint x, WGC3Dint y, WGC3Dsizei width, WGC3Dsizei height));
 };
 
@@ -1786,6 +1791,10 @@ public:
         // Any un-sanctioned calls to enable() are OK
         EXPECT_CALL(*m_context, enable(_))
             .WillRepeatedly(Return());
+
+        // Any un-sanctioned calls to disable() are OK
+        EXPECT_CALL(*m_context, disable(_))
+            .WillRepeatedly(Return());
     }
 
     void mustDrawSolidQuad()
@@ -1811,16 +1820,27 @@ public:
             .WillRepeatedly(Return());
     }
 
+    void mustSetNoScissor()
+    {
+        EXPECT_CALL(*m_context, disable(GraphicsContext3D::SCISSOR_TEST))
+            .WillRepeatedly(Return());
+
+        EXPECT_CALL(*m_context, enable(GraphicsContext3D::SCISSOR_TEST))
+            .Times(0);
+
+        EXPECT_CALL(*m_context, scissor(_, _, _, _))
+            .Times(0);
+    }
 };
 
 TEST_F(CCLayerTreeHostImplTest, noPartialSwap)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new MockContext));
     MockContext* mockContext = static_cast<MockContext*>(context->context3D());
     MockContextHarness harness(mockContext);
 
     harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 0, 10, 10);
+    harness.mustSetNoScissor();
 
     // Run test case
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = createLayerTreeHost(false, context.release(), FakeLayerWithQuads::create(1));
@@ -1834,50 +1854,35 @@ TEST_F(CCLayerTreeHostImplTest, noPartialSwap)
 
 TEST_F(CCLayerTreeHostImplTest, partialSwap)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new MockContext));
     MockContext* mockContext = static_cast<MockContext*>(context->context3D());
     MockContextHarness harness(mockContext);
 
-    harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 0, 10, 10);
-
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = createLayerTreeHost(true, context.release(), FakeLayerWithQuads::create(1));
 
-    CCLayerTreeHostImpl::FrameData frame;
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
+    // The first frame is not a partially-swapped one.
+    harness.mustSetNoScissor();
+    harness.mustDrawSolidQuad();
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
     Mock::VerifyAndClearExpectations(&mockContext);
-}
 
-TEST_F(CCLayerTreeHostImplTest, partialSwapNoUpdate)
-{
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockContext));
-    MockContext* mockContext = static_cast<MockContext*>(context->context3D());
-    MockContextHarness harness(mockContext);
+    // Damage a portion of the frame.
+    myHostImpl->rootLayer()->setUpdateRect(IntRect(0, 0, 2, 3));
 
+    // The second frame will be partially-swapped (the y coordinates are flipped).
+    harness.mustSetScissor(0, 7, 2, 3);
     harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 8, 2, 2);
-    harness.mustDrawSolidQuad();
-    harness.mustSetScissor(0, 0, 10, 10);
-
-    OwnPtr<CCLayerTreeHostImpl> myHostImpl = createLayerTreeHost(true, context.release(), FakeLayerWithQuads::create(1));
-
-    // Draw once to make sure layer is not new
-    CCLayerTreeHostImpl::FrameData frame;
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
-    // Generate update in layer
-    CCLayerImpl* root = myHostImpl->rootLayer();
-    root->setUpdateRect(FloatRect(0, 0, 2, 2));
-
-    // This draw should generate no new udpates
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
     Mock::VerifyAndClearExpectations(&mockContext);
 }
 
@@ -1907,12 +1912,12 @@ static PassOwnPtr<CCLayerTreeHostImpl> setupLayersForOpacity(bool partialSwap, C
 {
     CCSettings::setPartialSwapEnabled(partialSwap);
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     CCLayerTreeSettings settings;
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, client);
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(100, 100));
+    myHostImpl->setViewportSize(IntSize(100, 100), IntSize(100, 100));
 
     /*
       Layers are created as follows:
@@ -2013,59 +2018,6 @@ TEST_F(CCLayerTreeHostImplTest, contributingLayerEmptyScissorNoPartialSwap)
     }
 }
 
-TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnScissoredLayer)
-{
-    CCLayerTreeSettings settings;
-    CCSettings::setPartialSwapEnabled(true);
-
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
-    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
-    myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(10, 10));
-
-    myHostImpl->setRootLayer(DidDrawCheckLayer::create(1));
-    DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(myHostImpl->rootLayer());
-    root->setMasksToBounds(true);
-
-    root->addChild(DidDrawCheckLayer::create(2));
-    DidDrawCheckLayer* layer = static_cast<DidDrawCheckLayer*>(root->children()[0].get());
-
-    CCLayerTreeHostImpl::FrameData frame;
-
-    EXPECT_FALSE(root->willDrawCalled());
-    EXPECT_FALSE(root->didDrawCalled());
-    EXPECT_FALSE(layer->willDrawCalled());
-    EXPECT_FALSE(layer->didDrawCalled());
-
-    // We should draw everything the first frame.
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
-    EXPECT_TRUE(root->willDrawCalled());
-    EXPECT_TRUE(root->didDrawCalled());
-    EXPECT_TRUE(layer->willDrawCalled());
-    EXPECT_TRUE(layer->didDrawCalled());
-
-    root->clearDidDrawCheck();
-    layer->clearDidDrawCheck();
-
-    EXPECT_FALSE(root->willDrawCalled());
-    EXPECT_FALSE(root->didDrawCalled());
-    EXPECT_FALSE(layer->willDrawCalled());
-    EXPECT_FALSE(layer->didDrawCalled());
-
-    // Drawing again, we should scissor out everything since there is no damage.
-    EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-    myHostImpl->drawLayers(frame);
-    myHostImpl->didDrawAllLayers(frame);
-
-    EXPECT_FALSE(root->willDrawCalled());
-    EXPECT_FALSE(root->didDrawCalled());
-    EXPECT_FALSE(layer->willDrawCalled());
-    EXPECT_FALSE(layer->didDrawCalled());
-}
-
 // Make sure that context lost notifications are propagated through the tree.
 class ContextLostNotificationCheckLayer : public CCLayerImpl {
 public:
@@ -2118,20 +2070,10 @@ public:
 TEST_F(CCLayerTreeHostImplTest, finishAllRenderingAfterContextLost)
 {
     // The context initialization will fail, but we should still be able to call finishAllRendering() without any ill effects.
-    m_hostImpl->initializeLayerRenderer(CCGraphicsContext::create3D(adoptPtr(new FakeWebGraphicsContext3DMakeCurrentFails)), UnthrottledUploader);
+    m_hostImpl->initializeLayerRenderer(FakeWebCompositorOutputSurface::create(adoptPtr(new FakeWebGraphicsContext3DMakeCurrentFails)), UnthrottledUploader);
     m_hostImpl->finishAllRendering();
 }
 
-class ScrollbarLayerFakePaint : public CCScrollbarLayerImpl {
-public:
-    static PassOwnPtr<ScrollbarLayerFakePaint> create(int id) { return adoptPtr(new ScrollbarLayerFakePaint(id)); }
-
-    virtual void paint(GraphicsContext*) { }
-
-private:
-    ScrollbarLayerFakePaint(int id) : CCScrollbarLayerImpl(id) { }
-};
-
 // Fake WebGraphicsContext3D that will cause a failure if trying to use a
 // resource that wasn't created by it (resources created by
 // FakeWebGraphicsContext3D have an id of 1).
@@ -2235,25 +2177,28 @@ private:
 // Fake video frame that represents a 4x4 YUV video frame.
 class FakeVideoFrame: public WebVideoFrame {
 public:
-    FakeVideoFrame() { memset(m_data, 0x80, sizeof(m_data)); }
+    FakeVideoFrame() : m_textureId(0) { memset(m_data, 0x80, sizeof(m_data)); }
     virtual ~FakeVideoFrame() { }
-    virtual Format format() const { return FormatYV12; }
+    virtual Format format() const { return m_textureId ? FormatNativeTexture : FormatYV12; }
     virtual unsigned width() const { return 4; }
     virtual unsigned height() const { return 4; }
     virtual unsigned planes() const { return 3; }
     virtual int stride(unsigned plane) const { return 4; }
     virtual const void* data(unsigned plane) const { return m_data; }
-    virtual unsigned textureId() const { return 0; }
-    virtual unsigned textureTarget() const { return 0; }
+    virtual unsigned textureId() const { return m_textureId; }
+    virtual unsigned textureTarget() const { return m_textureId ? GraphicsContext3D::TEXTURE_2D : 0; }
+
+    void setTextureId(unsigned id) { m_textureId = id; }
 
 private:
     char m_data[16];
+    unsigned m_textureId;
 };
 
 // Fake video frame provider that always provides the same FakeVideoFrame.
 class FakeVideoFrameProvider: public WebVideoFrameProvider {
 public:
-    FakeVideoFrameProvider() : m_client(0) { }
+    FakeVideoFrameProvider() : m_frame(0), m_client(0) { }
     virtual ~FakeVideoFrameProvider()
     {
         if (m_client)
@@ -2261,11 +2206,13 @@ public:
     }
 
     virtual void setVideoFrameProviderClient(Client* client) { m_client = client; }
-    virtual WebVideoFrame* getCurrentFrame() { return &m_frame; }
+    virtual WebVideoFrame* getCurrentFrame() { return m_frame; }
     virtual void putCurrentFrame(WebVideoFrame*) { }
 
+    void setFrame(WebVideoFrame* frame) { m_frame = frame; }
+
 private:
-    FakeVideoFrame m_frame;
+    WebVideoFrame* m_frame;
     Client* m_client;
 };
 
@@ -2291,6 +2238,45 @@ public:
     }
 };
 
+class FakeWebScrollbarThemeGeometryNonEmpty : public FakeWebScrollbarThemeGeometry {
+    virtual WebRect trackRect(WebScrollbar*) OVERRIDE { return WebRect(0, 0, 10, 10); }
+    virtual WebRect thumbRect(WebScrollbar*) OVERRIDE { return WebRect(0, 5, 5, 2); }
+    virtual void splitTrack(WebScrollbar*, const WebRect& track, WebRect& startTrack, WebRect& thumb, WebRect& endTrack) OVERRIDE
+    {
+        thumb = WebRect(0, 5, 5, 2);
+        startTrack = WebRect(0, 5, 0, 5);
+        endTrack = WebRect(0, 0, 0, 5);
+    }
+};
+
+class FakeScrollbarLayerImpl : public CCScrollbarLayerImpl {
+public:
+    static PassOwnPtr<FakeScrollbarLayerImpl> create(int id)
+    {
+        return adoptPtr(new FakeScrollbarLayerImpl(id));
+    }
+
+    void createResources(CCResourceProvider* provider)
+    {
+        ASSERT(provider);
+        int pool = 0;
+        IntSize size(10, 10);
+        GC3Denum format = GraphicsContext3D::RGBA;
+        CCResourceProvider::TextureUsageHint hint = CCResourceProvider::TextureUsageAny;
+        setScrollbarGeometry(FakeWebScrollbarThemeGeometryNonEmpty::create());
+
+        setBackTrackResourceId(provider->createResource(pool, size, format, hint));
+        setForeTrackResourceId(provider->createResource(pool, size, format, hint));
+        setThumbResourceId(provider->createResource(pool, size, format, hint));
+    }
+
+protected:
+    explicit FakeScrollbarLayerImpl(int id)
+        : CCScrollbarLayerImpl(id)
+    {
+    }
+};
+
 TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
 {
     OwnPtr<CCLayerImpl> rootLayer(CCLayerImpl::create(1));
@@ -2317,7 +2303,9 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     textureLayer->setTextureId(1);
     rootLayer->addChild(textureLayer.release());
 
+    FakeVideoFrame videoFrame;
     FakeVideoFrameProvider provider;
+    provider.setFrame(&videoFrame);
     OwnPtr<CCVideoLayerImpl> videoLayer = CCVideoLayerImpl::create(4, &provider);
     videoLayer->setBounds(IntSize(10, 10));
     videoLayer->setAnchorPoint(FloatPoint(0, 0));
@@ -2326,7 +2314,18 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     videoLayer->setLayerTreeHostImpl(m_hostImpl.get());
     rootLayer->addChild(videoLayer.release());
 
-    OwnPtr<CCIOSurfaceLayerImpl> ioSurfaceLayer = CCIOSurfaceLayerImpl::create(5);
+    FakeVideoFrame hwVideoFrame;
+    FakeVideoFrameProvider hwProvider;
+    hwProvider.setFrame(&hwVideoFrame);
+    OwnPtr<CCVideoLayerImpl> hwVideoLayer = CCVideoLayerImpl::create(5, &hwProvider);
+    hwVideoLayer->setBounds(IntSize(10, 10));
+    hwVideoLayer->setAnchorPoint(FloatPoint(0, 0));
+    hwVideoLayer->setContentBounds(IntSize(10, 10));
+    hwVideoLayer->setDrawsContent(true);
+    hwVideoLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    rootLayer->addChild(hwVideoLayer.release());
+
+    OwnPtr<CCIOSurfaceLayerImpl> ioSurfaceLayer = CCIOSurfaceLayerImpl::create(6);
     ioSurfaceLayer->setBounds(IntSize(10, 10));
     ioSurfaceLayer->setAnchorPoint(FloatPoint(0, 0));
     ioSurfaceLayer->setContentBounds(IntSize(10, 10));
@@ -2335,8 +2334,27 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     ioSurfaceLayer->setLayerTreeHostImpl(m_hostImpl.get());
     rootLayer->addChild(ioSurfaceLayer.release());
 
+    OwnPtr<CCHeadsUpDisplayLayerImpl> hudLayer = CCHeadsUpDisplayLayerImpl::create(7);
+    hudLayer->setBounds(IntSize(10, 10));
+    hudLayer->setAnchorPoint(FloatPoint(0, 0));
+    hudLayer->setContentBounds(IntSize(10, 10));
+    hudLayer->setDrawsContent(true);
+    hudLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    rootLayer->addChild(hudLayer.release());
+
+    OwnPtr<FakeScrollbarLayerImpl> scrollbarLayer(FakeScrollbarLayerImpl::create(8));
+    scrollbarLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    scrollbarLayer->setBounds(IntSize(10, 10));
+    scrollbarLayer->setContentBounds(IntSize(10, 10));
+    scrollbarLayer->setDrawsContent(true);
+    scrollbarLayer->setLayerTreeHostImpl(m_hostImpl.get());
+    scrollbarLayer->createResources(m_hostImpl->resourceProvider());
+    rootLayer->addChild(scrollbarLayer.release());
+
     // Use a context that supports IOSurfaces
-    m_hostImpl->initializeLayerRenderer(CCGraphicsContext::create3D(adoptPtr(new FakeWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+    m_hostImpl->initializeLayerRenderer(FakeWebCompositorOutputSurface::create(adoptPtr(new FakeWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+
+    hwVideoFrame.setTextureId(m_hostImpl->resourceProvider()->graphicsContext3D()->createTexture());
 
     m_hostImpl->setRootLayer(rootLayer.release());
 
@@ -2346,9 +2364,29 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     m_hostImpl->didDrawAllLayers(frame);
     m_hostImpl->swapBuffers();
 
+    unsigned numResources = m_hostImpl->resourceProvider()->numResources();
+
     // Lose the context, replacing it with a StrictWebGraphicsContext3DWithIOSurface,
     // that will warn if any resource from the previous context gets used.
-    m_hostImpl->initializeLayerRenderer(CCGraphicsContext::create3D(adoptPtr(new StrictWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+    m_hostImpl->initializeLayerRenderer(FakeWebCompositorOutputSurface::create(adoptPtr(new StrictWebGraphicsContext3DWithIOSurface)), UnthrottledUploader);
+
+    // Create dummy resources so that looking up an old resource will get an
+    // invalid texture id mapping.
+    for (unsigned i = 0; i < numResources; ++i)
+        m_hostImpl->resourceProvider()->createResourceFromExternalTexture(1);
+
+    // The WebVideoFrameProvider is expected to recreate its textures after a
+    // lost context (or not serve a frame).
+    hwProvider.setFrame(0);
+
+    EXPECT_TRUE(m_hostImpl->prepareToDraw(frame));
+    m_hostImpl->drawLayers(frame);
+    m_hostImpl->didDrawAllLayers(frame);
+    m_hostImpl->swapBuffers();
+
+    hwVideoFrame.setTextureId(m_hostImpl->resourceProvider()->graphicsContext3D()->createTexture());
+    hwProvider.setFrame(&hwVideoFrame);
+
     EXPECT_TRUE(m_hostImpl->prepareToDraw(frame));
     m_hostImpl->drawLayers(frame);
     m_hostImpl->didDrawAllLayers(frame);
@@ -2441,7 +2479,7 @@ TEST_F(CCLayerTreeHostImplTest, layersFreeTextures)
     rootLayer->addChild(ioSurfaceLayer.release());
 
     // Lose the context, replacing it with a TrackingWebGraphicsContext3D (which the CCLayerTreeHostImpl takes ownership of).
-    OwnPtr<CCGraphicsContext> ccContext(CCGraphicsContext::create3D(adoptPtr(new TrackingWebGraphicsContext3D)));
+    OwnPtr<CCGraphicsContext> ccContext(FakeWebCompositorOutputSurface::create(adoptPtr(new TrackingWebGraphicsContext3D)));
     TrackingWebGraphicsContext3D* trackingWebGraphicsContext = static_cast<TrackingWebGraphicsContext3D*>(ccContext->context3D());
     m_hostImpl->initializeLayerRenderer(ccContext.release(), UnthrottledUploader);
 
@@ -2469,7 +2507,7 @@ public:
 
 TEST_F(CCLayerTreeHostImplTest, hasTransparentBackground)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new MockDrawQuadsToFillScreenContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new MockDrawQuadsToFillScreenContext));
     MockDrawQuadsToFillScreenContext* mockContext = static_cast<MockDrawQuadsToFillScreenContext*>(context->context3D());
 
     // Run test case
@@ -2513,10 +2551,10 @@ static void addDrawingLayerTo(CCLayerImpl* parent, int id, const IntRect& layerR
 
 static void setupLayersForTextureCaching(CCLayerTreeHostImpl* layerTreeHostImpl, CCLayerImpl*& rootPtr, CCLayerImpl*& intermediateLayerPtr, CCLayerImpl*& surfaceLayerPtr, CCLayerImpl*& childPtr, const IntSize& rootSize)
 {
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     layerTreeHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    layerTreeHostImpl->setViewportSize(rootSize);
+    layerTreeHostImpl->setViewportSize(rootSize, rootSize);
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2538,7 +2576,7 @@ static void setupLayersForTextureCaching(CCLayerTreeHostImpl* layerTreeHostImpl,
     surfaceLayerPtr->setOpacity(0.5f); // This will cause it to have a surface
 
     // Child of the surface layer will produce some quads
-    addDrawingLayerTo(surfaceLayerPtr, 4, IntRect(5, 5, rootSize.width(), rootSize.height()), &childPtr);
+    addDrawingLayerTo(surfaceLayerPtr, 4, IntRect(5, 5, rootSize.width() - 25, rootSize.height() - 25), &childPtr);
 }
 
 class LayerRendererChromiumWithReleaseTextures : public LayerRendererChromium {
@@ -2551,17 +2589,18 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithClipping)
     CCSettings::setPartialSwapEnabled(true);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     CCLayerImpl* rootPtr;
     CCLayerImpl* surfaceLayerPtr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(100, 100);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2601,12 +2640,15 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithClipping)
         EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
         ASSERT_EQ(1U, frame.renderPasses[1]->quadList().size());
 
-        // Verify that the child layers have been drawn entirely.
+        // Verify that the child layers are being clipped.
         IntRect quadVisibleRect = frame.renderPasses[0]->quadList()[0]->quadVisibleRect();
-        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 3), quadVisibleRect);
+        EXPECT_LT(quadVisibleRect.width(), 100);
 
         quadVisibleRect = frame.renderPasses[0]->quadList()[1]->quadVisibleRect();
-        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 3), quadVisibleRect);
+        EXPECT_LT(quadVisibleRect.width(), 100);
+
+        // Verify that the render surface texture is *not* clipped.
+        EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 100), frame.renderPasses[0]->outputRect());
 
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
@@ -2623,15 +2665,16 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithClipping)
     surfaceLayerPtr->setTransform(transform);
 
     // The surface is now aligned again, and the clipped parts are exposed.
-    // That should be OK, as we've already verified that the quads are drawn in full.
-    // Verify that the render pass is removed.
+    // Since the layers were clipped, even though the render surface size
+    // was not changed, the texture should not be saved.
     {
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // Must receive a single render pass using a cached texture.
-        ASSERT_EQ(1U, frame.renderPasses.size());
-        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        // Must receive two render passes, each with one quad
+        ASSERT_EQ(2U, frame.renderPasses.size());
+        EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
+        ASSERT_EQ(1U, frame.renderPasses[1]->quadList().size());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -2643,6 +2686,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusion)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structure as follows:
@@ -2663,12 +2707,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusion)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2698,11 +2742,11 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusion)
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
         // Must receive 3 render passes.
-        // For Root, there are 2 quads; for S1, there are 3 quads; for S2, there is 1 quad.
+        // For Root, there are 2 quads; for S1, there are 2 quads (1 is occluded); for S2, there is 2 quads.
         ASSERT_EQ(3U, frame.renderPasses.size());
 
         EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(3U, frame.renderPasses[1]->quadList().size());
+        EXPECT_EQ(2U, frame.renderPasses[1]->quadList().size());
         EXPECT_EQ(2U, frame.renderPasses[2]->quadList().size());
 
         myHostImpl->drawLayers(frame);
@@ -2758,6 +2802,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionEarlyOut)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structure as follows:
@@ -2775,12 +2820,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionEarlyOut)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2873,6 +2918,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionExternalOverInternal)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structured as follows:
@@ -2888,12 +2934,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionExternalOverInternal)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -2971,12 +3017,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionExternalNotAligned)
     CCLayerImpl* rootPtr;
     CCLayerImpl* layerS1Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -3035,6 +3081,7 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
     CCSettings::setPartialSwapEnabled(true);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     // Layers are structure as follows:
@@ -3055,12 +3102,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
     CCLayerImpl* layerS1Ptr;
     CCLayerImpl* layerS2Ptr;
 
-    OwnPtr<CCGraphicsContext> context = CCGraphicsContext::create3D(adoptPtr(new PartialSwapContext));
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
 
     IntSize rootSize(1000, 1000);
 
     myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
-    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()));
+    myHostImpl->setViewportSize(IntSize(rootSize.width(), rootSize.height()), IntSize(rootSize.width(), rootSize.height()));
 
     OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     rootPtr = root.get();
@@ -3090,11 +3137,11 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
         // Must receive 3 render passes.
-        // For Root, there are 2 quads; for S1, there are 3 quads; for S2, there is 1 quad.
+        // For Root, there are 2 quads; for S1, there are 2 quads (one is occluded); for S2, there is 2 quads.
         ASSERT_EQ(3U, frame.renderPasses.size());
 
         EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(3U, frame.renderPasses[1]->quadList().size());
+        EXPECT_EQ(2U, frame.renderPasses[1]->quadList().size());
         EXPECT_EQ(2U, frame.renderPasses[2]->quadList().size());
 
         myHostImpl->drawLayers(frame);
@@ -3112,12 +3159,12 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
         // Must receive 2 render passes.
-        // For Root, there are 2 quads
-        // For S1, the number of quads depends on what got unoccluded, so not asserted beyond being positive.
+        // For Root, there are 2 quads.
+        // For S1, there are 2 quads.
         // For S2, there is no render pass
         ASSERT_EQ(2U, frame.renderPasses.size());
 
-        EXPECT_GT(frame.renderPasses[0]->quadList().size(), 0U);
+        EXPECT_EQ(2U, frame.renderPasses[0]->quadList().size());
         EXPECT_EQ(2U, frame.renderPasses[1]->quadList().size());
 
         myHostImpl->drawLayers(frame);
@@ -3127,9 +3174,6 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
     // "Re-occlude" surface S1 and repeat draw.
     // Must remove S1's render pass since it is now available in full.
     // S2 has no change so must also be removed.
-    // FIXME: Due to partial swap, the scissor rect will cause OcclusionTracker
-    // to think there is an external occlusion in the previous step. Therefore,
-    // S1's render pass will not be removed.
     transform = layerS2Ptr->transform();
     transform.translate(-15, -15);
     layerS2Ptr->setTransform(transform);
@@ -3137,19 +3181,118 @@ TEST_F(CCLayerTreeHostImplTest, textureCachingWithOcclusionPartialSwap)
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // 2 Render passes - Root and S1.
-        ASSERT_EQ(2U, frame.renderPasses.size());
+        // Root render pass only.
+        ASSERT_EQ(1U, frame.renderPasses.size());
 
-        // Render pass for S1 contains no quads as the scissor rect is now occluded.
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+}
 
-        // Root contains S2 only, as S1 doesn't have any damage.
-        EXPECT_EQ(1U, frame.renderPasses[1]->quadList().size());
+TEST_F(CCLayerTreeHostImplTest, textureCachingWithScissor)
+{
+    CCSettings::setPartialSwapEnabled(false);
 
+    CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
+    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
+
+    /*
+      Layers are created as follows:
+
+         +--------------------+
+         |                  1 |
+         |  +-----------+     |
+         |  |         2 |     |
+         |  | +-------------------+
+         |  | |   3               |
+         |  | +-------------------+
+         |  |           |     |
+         |  +-----------+     |
+         |                    |
+         |                    |
+         +--------------------+
+
+         Layers 1, 2 have render surfaces
+     */
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    OwnPtr<CCTiledLayerImpl> child = CCTiledLayerImpl::create(2);
+    OwnPtr<CCLayerImpl> grandChild = CCLayerImpl::create(3);
+
+    IntRect rootRect(0, 0, 100, 100);
+    IntRect childRect(10, 10, 50, 50);
+    IntRect grandChildRect(5, 5, 150, 150);
+
+    OwnPtr<CCGraphicsContext> context = FakeWebCompositorOutputSurface::create(adoptPtr(new PartialSwapContext));
+    myHostImpl->initializeLayerRenderer(context.release(), UnthrottledUploader);
+
+    root->setAnchorPoint(FloatPoint(0, 0));
+    root->setPosition(FloatPoint(rootRect.x(), rootRect.y()));
+    root->setBounds(IntSize(rootRect.width(), rootRect.height()));
+    root->setContentBounds(root->bounds());
+    root->setDrawsContent(true);
+    root->setMasksToBounds(true);
+
+    child->setAnchorPoint(FloatPoint(0, 0));
+    child->setPosition(FloatPoint(childRect.x(), childRect.y()));
+    child->setOpacity(0.5);
+    child->setBounds(IntSize(childRect.width(), childRect.height()));
+    child->setContentBounds(child->bounds());
+    child->setDrawsContent(true);
+    child->setSkipsDraw(false);
+
+    // child layer has 10x10 tiles.
+    OwnPtr<CCLayerTilingData> tiler = CCLayerTilingData::create(IntSize(10, 10), CCLayerTilingData::HasBorderTexels);
+    tiler->setBounds(child->contentBounds());
+    child->setTilingData(*tiler.get());
+
+    grandChild->setAnchorPoint(FloatPoint(0, 0));
+    grandChild->setPosition(IntPoint(grandChildRect.x(), grandChildRect.y()));
+    grandChild->setBounds(IntSize(grandChildRect.width(), grandChildRect.height()));
+    grandChild->setContentBounds(grandChild->bounds());
+    grandChild->setDrawsContent(true);
+
+    CCTiledLayerImpl* childPtr = child.get();
+
+    child->addChild(grandChild.release());
+    root->addChild(child.release());
+    myHostImpl->setRootLayer(root.release());
+    myHostImpl->setViewportSize(rootRect.size(), rootRect.size());
+
+    EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
+
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
     }
 
+    // We should have cached textures for surface 2.
+    EXPECT_TRUE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
+
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // We should still have cached textures for surface 2 after drawing with no damage.
+    EXPECT_TRUE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
+
+    // Damage a single tile of surface 2.
+    childPtr->setUpdateRect(IntRect(10, 10, 10, 10));
+
+    {
+        CCLayerTreeHostImpl::FrameData frame;
+        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
+        myHostImpl->drawLayers(frame);
+        myHostImpl->didDrawAllLayers(frame);
+    }
+
+    // We should have a cached texture for surface 2 again even though it was damaged.
+    EXPECT_TRUE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(childPtr->id()));
 }
 
 TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
@@ -3157,6 +3300,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
     CCSettings::setPartialSwapEnabled(true);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     CCLayerImpl* rootPtr;
@@ -3178,7 +3322,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3189,10 +3333,14 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // Must receive two EMPTY render passes
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(0U, frame.renderPasses[1]->quadList().size());
+        // Must receive one render pass, as the other one should be culled
+        ASSERT_EQ(1U, frame.renderPasses.size());
+
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
+        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3211,7 +3359,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3232,7 +3380,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3259,7 +3407,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         // Was our surface evicted?
         EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(targetPass->id()));
@@ -3273,10 +3421,14 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         CCLayerTreeHostImpl::FrameData frame;
         EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
 
-        // Must receive two EMPTY render passes
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(0U, frame.renderPasses[1]->quadList().size());
+        // Must receive one render pass, as the other one should be culled
+        ASSERT_EQ(1U, frame.renderPasses.size());
+
+        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
+        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
+        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
+        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3297,7 +3449,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3309,6 +3461,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
     CCSettings::setPartialSwapEnabled(false);
 
     CCLayerTreeSettings settings;
+    settings.minimumOcclusionTrackingSize = IntSize();
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
 
     CCLayerImpl* rootPtr;
@@ -3330,7 +3483,13 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
+
+        EXPECT_FALSE(frame.renderPasses[0]->damageRect().isEmpty());
+        EXPECT_FALSE(frame.renderPasses[1]->damageRect().isEmpty());
+
+        EXPECT_FALSE(frame.renderPasses[0]->hasOcclusionFromOutsideTargetSurface());
+        EXPECT_FALSE(frame.renderPasses[1]->hasOcclusionFromOutsideTargetSurface());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3347,6 +3506,8 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         ASSERT_EQ(1U, frame.renderPasses.size());
         EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
 
+        EXPECT_TRUE(frame.renderPasses[0]->damageRect().isEmpty());
+
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
     }
@@ -3364,7 +3525,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3385,7 +3546,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_FALSE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3412,7 +3573,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         // Was our surface evicted?
         EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(targetPass->id()));
@@ -3451,83 +3612,7 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
         CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
-
-        myHostImpl->drawLayers(frame);
-        myHostImpl->didDrawAllLayers(frame);
-    }
-}
-
-// FIXME: This test is temporary until memory management in render surfaces gets refactored.
-// It depends on implementation of TextureManager and needs to get removed as
-// it will become meaningless with a different implementation.
-TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingMemoryLimit)
-{
-    CCSettings::setPartialSwapEnabled(true);
-
-    CCLayerTreeSettings settings;
-    OwnPtr<CCLayerTreeHostImpl> myHostImpl = CCLayerTreeHostImpl::create(settings, this);
-
-    CCLayerImpl* rootPtr;
-    CCLayerImpl* intermediateLayerPtr;
-    CCLayerImpl* surfaceLayerPtr;
-    CCLayerImpl* childPtr;
-
-    // FIXME: The number 4200 is the "magic" number which will cause render surface size
-    // to go above 64M. This will bring it above reclaimLimitBytes().
-    // We could compute this number from return value of reclaimLimitBytes(), however
-    // it takes a viewport, so it's no better as it still contains same kind of assumption
-    // (namely that reclaimLimitBytes() ignores viewport size).
-    IntSize largeSurfaceSize(4200, 4200);
-    setupLayersForTextureCaching(myHostImpl.get(), rootPtr, intermediateLayerPtr, surfaceLayerPtr, childPtr, largeSurfaceSize);
-
-    {
-        CCLayerTreeHostImpl::FrameData frame;
-        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-
-        // Must receive two render passes, each with one quad
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(1U, frame.renderPasses[1]->quadList().size());
-
-        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[1]->quadList()[0]->material());
-        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
-        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_TRUE(targetPass->targetSurface()->contentsChanged());
-
-        myHostImpl->drawLayers(frame);
-        myHostImpl->didDrawAllLayers(frame);
-    }
-
-    // Draw without any change
-    {
-        CCLayerTreeHostImpl::FrameData frame;
-        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-
-        // Must receive two EMPTY render passes
-        ASSERT_EQ(2U, frame.renderPasses.size());
-        EXPECT_EQ(0U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(0U, frame.renderPasses[1]->quadList().size());
-
-        myHostImpl->drawLayers(frame);
-        myHostImpl->didDrawAllLayers(frame);
-    }
-
-    // Change opacity and draw.
-    // If all goes well, the texture must still be available, even though it's really big.
-    surfaceLayerPtr->setOpacity(0.6f);
-    {
-        CCLayerTreeHostImpl::FrameData frame;
-        EXPECT_TRUE(myHostImpl->prepareToDraw(frame));
-
-        // Must receive one render pass, as the other one should be culled
-        ASSERT_EQ(1U, frame.renderPasses.size());
-
-        EXPECT_EQ(1U, frame.renderPasses[0]->quadList().size());
-        EXPECT_EQ(CCDrawQuad::RenderPass, frame.renderPasses[0]->quadList()[0]->material());
-        CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[0]->quadList()[0].get());
-        CCRenderPass* targetPass = frame.renderPassesById.get(quad->renderPassId());
-        EXPECT_FALSE(targetPass->targetSurface()->contentsChanged());
+        EXPECT_TRUE(targetPass->damageRect().isEmpty());
 
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
@@ -3698,7 +3783,7 @@ static void configureRenderPassTestData(const char* testScript, RenderPassRemova
 
                 IntRect quadRect = IntRect(0, 0, 1, 1);
                 IntRect contentsChangedRect = contentsChanged ? quadRect : IntRect();
-                OwnPtr<CCRenderPassDrawQuad> quad = CCRenderPassDrawQuad::create(testData.sharedQuadState.get(), quadRect, newRenderPassId, isReplica, 1, contentsChangedRect);
+                OwnPtr<CCRenderPassDrawQuad> quad = CCRenderPassDrawQuad::create(testData.sharedQuadState.get(), quadRect, newRenderPassId, isReplica, 1, contentsChangedRect, 1, 1, 0, 0);
                 static_cast<CCTestRenderPass*>(renderPass.get())->appendQuad(quad.release());
             }
         }
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
index ea7678b02..137e6249a 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
@@ -26,20 +26,18 @@
 
 #include "cc/CCLayerTreeHost.h"
 
-#include "AnimationIdVendor.h"
 #include "CCOcclusionTrackerTestCommon.h"
 #include "CCThreadedTest.h"
 #include "ContentLayerChromium.h"
-#include "GraphicsContext3DPrivate.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCSettings.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include "cc/CCTimingFunction.h"
-#include "platform/WebThread.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <public/Platform.h>
+#include <public/WebThread.h>
 #include <wtf/MainThread.h>
 #include <wtf/OwnArrayPtr.h>
 
@@ -339,7 +337,7 @@ public:
         m_numCommits++;
         if (m_numCommits == 1) {
             // Make the viewport empty so the host says it can't draw.
-            m_layerTreeHost->setViewportSize(IntSize(0, 0));
+            m_layerTreeHost->setViewportSize(IntSize(0, 0), IntSize(0, 0));
 
             OwnArrayPtr<char> pixels(adoptArrayPtr(new char[4]));
             m_layerTreeHost->compositeAndReadback(static_cast<void*>(pixels.get()), IntRect(0, 0, 1, 1));
@@ -747,7 +745,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->rootLayer()->setDrawOpacity(1);
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
         m_layerTreeHost->rootLayer()->setOpacity(0);
         postAddAnimationToMainThread();
     }
@@ -1006,8 +1004,8 @@ public:
 
     virtual void beginTest()
     {
-        m_layerTreeHost->setViewportSize(IntSize(20, 20));
-        m_layerTreeHost->setBackgroundColor(Color::gray);
+        m_layerTreeHost->setViewportSize(IntSize(20, 20), IntSize(20, 20));
+        m_layerTreeHost->setBackgroundColor(SK_ColorGRAY);
         m_layerTreeHost->setPageScaleFactorAndLimits(5, 5, 5);
 
         postSetNeedsCommitToMainThread();
@@ -1015,8 +1013,8 @@ public:
 
     virtual void commitCompleteOnCCThread(CCLayerTreeHostImpl* impl)
     {
-        EXPECT_EQ(IntSize(20, 20), impl->viewportSize());
-        EXPECT_EQ(Color::gray, impl->backgroundColor());
+        EXPECT_EQ(IntSize(20, 20), impl->layoutViewportSize());
+        EXPECT_EQ(SK_ColorGRAY, impl->backgroundColor());
         EXPECT_EQ(5, impl->pageScale());
 
         endTest();
@@ -1160,9 +1158,9 @@ public:
     int paintContentsCount() { return m_paintContentsCount; }
     void resetPaintContentsCount() { m_paintContentsCount = 0; }
 
-    virtual void update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion, CCRenderingStats& stats) OVERRIDE
+    virtual void update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats) OVERRIDE
     {
-        ContentLayerChromium::update(updater, occlusion, stats);
+        ContentLayerChromium::update(queue, occlusion, stats);
         m_paintContentsCount++;
     }
 
@@ -1191,7 +1189,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->setRootLayer(m_updateCheckLayer);
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
 
         postSetNeedsCommitToMainThread();
     }
@@ -1239,10 +1237,9 @@ public:
 
     virtual void beginTest()
     {
-        // The device viewport should be scaled by the device scale factor.
-        m_layerTreeHost->setViewportSize(IntSize(40, 40));
+        m_layerTreeHost->setViewportSize(IntSize(40, 40), IntSize(60, 60));
         m_layerTreeHost->setDeviceScaleFactor(1.5);
-        EXPECT_EQ(IntSize(40, 40), m_layerTreeHost->viewportSize());
+        EXPECT_EQ(IntSize(40, 40), m_layerTreeHost->layoutViewportSize());
         EXPECT_EQ(IntSize(60, 60), m_layerTreeHost->deviceViewportSize());
 
         m_rootLayer->addChild(m_childLayer);
@@ -1273,7 +1270,7 @@ public:
         ASSERT_EQ(1u, impl->rootLayer()->children().size());
 
         // Device viewport is scaled.
-        EXPECT_EQ(IntSize(40, 40), impl->viewportSize());
+        EXPECT_EQ(IntSize(40, 40), impl->layoutViewportSize());
         EXPECT_EQ(IntSize(60, 60), impl->deviceViewportSize());
 
         CCLayerImpl* root = impl->rootLayer();
@@ -1347,7 +1344,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->setRootLayer(m_layer);
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
 
         postSetNeedsCommitToMainThread();
         postSetNeedsRedrawToMainThread();
@@ -1447,7 +1444,7 @@ public:
     virtual void beginTest()
     {
         m_layerTreeHost->setRootLayer(m_parent);
-        m_layerTreeHost->setViewportSize(IntSize(10, 20));
+        m_layerTreeHost->setViewportSize(IntSize(10, 20), IntSize(10, 20));
 
         WebTransformationMatrix identityMatrix;
         setLayerPropertiesForTesting(m_parent.get(), 0, identityMatrix, FloatPoint(0, 0), FloatPoint(0, 0), IntSize(10, 20), true);
@@ -1543,10 +1540,10 @@ public:
             break;
         case 3:
             m_child->setNeedsDisplay();
-            m_layerTreeHost->setViewportSize(IntSize(10, 10));
+            m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
             break;
         case 4:
-            m_layerTreeHost->setViewportSize(IntSize(10, 20));
+            m_layerTreeHost->setViewportSize(IntSize(10, 20), IntSize(10, 20));
             break;
         default:
             ASSERT_NOT_REACHED();
@@ -1574,7 +1571,7 @@ class TestLayerChromium : public LayerChromium {
 public:
     static PassRefPtr<TestLayerChromium> create() { return adoptRef(new TestLayerChromium()); }
 
-    virtual void update(CCTextureUpdater&, const CCOcclusionTracker* occlusion, CCRenderingStats&) OVERRIDE
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker* occlusion, CCRenderingStats&) OVERRIDE
     {
         // Gain access to internals of the CCOcclusionTracker.
         const TestCCOcclusionTracker* testOcclusion = static_cast<const TestCCOcclusionTracker*>(occlusion);
@@ -1627,10 +1624,10 @@ public:
         setTestLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
         ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
-        CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        CCTextureUpdateQueue queue;
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1646,8 +1643,8 @@ public:
         setLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1664,8 +1661,8 @@ public:
         setTestLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1684,8 +1681,8 @@ public:
         setTestLayerPropertiesForTesting(grandChild.get(), child.get(), identityMatrix, FloatPoint(0, 0), FloatPoint(10, 10), IntSize(500, 500), true);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1706,8 +1703,8 @@ public:
         child->setMaskLayer(mask.get());
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1728,8 +1725,8 @@ public:
         child->setMaskLayer(mask.get());
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1751,8 +1748,8 @@ public:
         child->setOpacity(0.5);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), grandChild->occludedScreenSpace().bounds());
@@ -1774,8 +1771,8 @@ public:
         child->setOpacity(0.5);
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1835,10 +1832,10 @@ public:
         }
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
         ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
-        CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        CCTextureUpdateQueue queue;
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1864,8 +1861,8 @@ public:
         }
 
         m_layerTreeHost->setRootLayer(rootLayer);
-        m_layerTreeHost->setViewportSize(rootLayer->bounds());
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        m_layerTreeHost->setViewportSize(rootLayer->bounds(), rootLayer->bounds());
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         EXPECT_EQ_RECT(IntRect(), child2->occludedScreenSpace().bounds());
@@ -1924,10 +1921,10 @@ public:
         }
 
         m_layerTreeHost->setRootLayer(layers[0].get());
-        m_layerTreeHost->setViewportSize(layers[0]->bounds());
+        m_layerTreeHost->setViewportSize(layers[0]->bounds(), layers[0]->bounds());
         ASSERT_TRUE(m_layerTreeHost->initializeLayerRendererIfNeeded());
-        CCTextureUpdater updater;
-        m_layerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+        CCTextureUpdateQueue queue;
+        m_layerTreeHost->updateLayers(queue, std::numeric_limits<size_t>::max());
         m_layerTreeHost->commitComplete();
 
         for (int i = 0; i < numSurfaces-1; ++i) {
@@ -1951,7 +1948,7 @@ public:
 
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestManySurfaces)
 
-// A loseContext(1) should lead to a didRecreateContext(true)
+// A loseContext(1) should lead to a didRecreateOutputSurface(true)
 class CCLayerTreeHostTestSetSingleLostContext : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetSingleLostContext()
@@ -1968,7 +1965,7 @@ public:
         m_layerTreeHost->loseContext(1);
     }
 
-    virtual void didRecreateContext(bool succeeded)
+    virtual void didRecreateOutputSurface(bool succeeded)
     {
         EXPECT_TRUE(succeeded);
         endTest();
@@ -1984,7 +1981,7 @@ TEST_F(CCLayerTreeHostTestSetSingleLostContext, runMultiThread)
     runTest(true);
 }
 
-// A loseContext(10) should lead to a didRecreateContext(false), and
+// A loseContext(10) should lead to a didRecreateOutputSurface(false), and
 // a finishAllRendering() should not hang.
 class CCLayerTreeHostTestSetRepeatedLostContext : public CCLayerTreeHostTest {
 public:
@@ -2002,7 +1999,7 @@ public:
         m_layerTreeHost->loseContext(10);
     }
 
-    virtual void didRecreateContext(bool succeeded)
+    virtual void didRecreateOutputSurface(bool succeeded)
     {
         EXPECT_FALSE(succeeded);
         m_layerTreeHost->finishAllRendering();
@@ -2141,7 +2138,7 @@ public:
 
         // Any valid CCAnimationCurve will do here.
         OwnPtr<CCAnimationCurve> curve(CCEaseTimingFunction::create());
-        OwnPtr<CCActiveAnimation> animation(CCActiveAnimation::create(curve.release(), AnimationIdVendor::getNextAnimationId(), AnimationIdVendor::getNextGroupId(), CCActiveAnimation::Opacity));
+        OwnPtr<CCActiveAnimation> animation(CCActiveAnimation::create(curve.release(), 1, 1, CCActiveAnimation::Opacity));
         layer->layerAnimationController()->addAnimation(animation.release());
 
         // We add the animation *before* attaching the layer to the tree.
@@ -2173,7 +2170,7 @@ public:
 
     virtual void beginTest() OVERRIDE
     {
-        m_layerTreeHost->setViewportSize(IntSize(10, 10));
+        m_layerTreeHost->setViewportSize(IntSize(10, 10), IntSize(10, 10));
         m_layerTreeHost->rootLayer()->setBounds(IntSize(10, 10));
         
         m_rootScrollLayer = ContentLayerChromium::create(&m_mockDelegate);
@@ -2283,7 +2280,7 @@ public:
 
     virtual void beginTest()
     {
-        m_layerTreeHost->setViewportSize(IntSize(100, 100));
+        m_layerTreeHost->setViewportSize(IntSize(100, 100), IntSize(100, 100));
 
         m_rootLayer->setBounds(IntSize(100, 100));
         m_surfaceLayer1->setBounds(IntSize(100, 100));
diff --git a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
index 596b0692c..9d51c9970 100644
--- a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
@@ -31,7 +31,6 @@
 #include "CCOcclusionTrackerTestCommon.h"
 #include "LayerChromium.h"
 #include "Region.h"
-#include "TranslateTransformOperation.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHostCommon.h"
@@ -103,23 +102,23 @@ private:
 };
 
 template<typename LayerType, typename RenderSurfaceType>
-class TestCCOcclusionTrackerWithScissor : public TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType> {
+class TestCCOcclusionTrackerWithClip : public TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType> {
 public:
-    TestCCOcclusionTrackerWithScissor(IntRect screenScissorRect, bool recordMetricsForFrame = false)
-        : TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType>(screenScissorRect, recordMetricsForFrame)
-        , m_overrideLayerScissorRect(false)
+    TestCCOcclusionTrackerWithClip(IntRect viewportRect, bool recordMetricsForFrame = false)
+        : TestCCOcclusionTrackerBase<LayerType, RenderSurfaceType>(viewportRect, recordMetricsForFrame)
+        , m_overrideLayerClipRect(false)
     {
     }
 
-    void setLayerScissorRect(const IntRect& rect) { m_overrideLayerScissorRect = true; m_layerScissorRect = rect;}
-    void useDefaultLayerScissorRect() { m_overrideLayerScissorRect = false; }
+    void setLayerClipRect(const IntRect& rect) { m_overrideLayerClipRect = true; m_layerClipRect = rect;}
+    void useDefaultLayerClipRect() { m_overrideLayerClipRect = false; }
 
 protected:
-    virtual IntRect layerScissorRectInTargetSurface(const LayerType* layer) const { return m_overrideLayerScissorRect ? m_layerScissorRect : CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerScissorRectInTargetSurface(layer); }
+    virtual IntRect layerClipRectInTarget(const LayerType* layer) const { return m_overrideLayerClipRect ? m_layerClipRect : CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerClipRectInTarget(layer); }
 
 private:
-    bool m_overrideLayerScissorRect;
-    IntRect m_layerScissorRect;
+    bool m_overrideLayerClipRect;
+    IntRect m_layerClipRect;
 };
 
 struct CCOcclusionTrackerTestMainThreadTypes {
@@ -262,8 +261,7 @@ protected:
         ASSERT(!root->renderSurface());
 
         CCLayerTreeHostCommon::calculateDrawTransforms(root, root->bounds(), 1, &layerSorter, dummyMaxTextureSize, m_renderSurfaceLayerListImpl);
-
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(m_renderSurfaceLayerListImpl, root->renderSurface()->contentRect());
+        CCLayerTreeHostCommon::calculateVisibleRects(m_renderSurfaceLayerListImpl);
 
         m_layerIterator = m_layerIteratorBegin = Types::LayerIterator::begin(&m_renderSurfaceLayerListImpl);
     }
@@ -276,8 +274,7 @@ protected:
         ASSERT(!root->renderSurface());
 
         CCLayerTreeHostCommon::calculateDrawTransforms(root, root->bounds(), 1, dummyMaxTextureSize, m_renderSurfaceLayerListChromium);
-
-        CCLayerTreeHostCommon::calculateVisibleAndScissorRects(m_renderSurfaceLayerListChromium, root->renderSurface()->contentRect());
+        CCLayerTreeHostCommon::calculateVisibleRects(m_renderSurfaceLayerListChromium);
 
         m_layerIterator = m_layerIteratorBegin = Types::LayerIterator::begin(&m_renderSurfaceLayerListChromium);
     }
@@ -443,8 +440,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(30, 30), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterLayer(parent, occlusion);
@@ -460,13 +457,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(29, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 29, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(30, 30, 70, 70)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent, IntRect(29, 30, 70, 70)));
@@ -496,8 +493,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(parent, layerTransform, FloatPoint(30, 30), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterLayer(parent, occlusion);
@@ -513,13 +510,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(29, 30, 70, 70)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 29, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(31, 30, 70, 70)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 31, 70, 70)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(30, 30, 70, 70)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(29, 30, 1, 70), occlusion.unoccludedContentRect(parent, IntRect(29, 30, 70, 70)));
@@ -547,8 +544,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(parent, layerTransform, FloatPoint(30, 30), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterLayer(parent, occlusion);
@@ -564,13 +561,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(51, 50, 50, 50)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(50, 51, 50, 50)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(50, 50, 50, 50)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(49, 50, 50, 50)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(50, 49, 50, 50)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(51, 50, 50, 50)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(50, 51, 50, 50)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(50, 50, 50, 50)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(49, 50, 1, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 50, 50, 50)));
@@ -582,7 +579,7 @@ protected:
         EXPECT_INT_RECT_EQ(IntRect(50, 100, 50, 1), occlusion.unoccludedContentRect(parent, IntRect(50, 51, 50, 50)));
         EXPECT_INT_RECT_EQ(IntRect(49, 51, 50, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 51, 50, 50)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(50, 50, 50, 50)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(49, 50, 1, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 50, 50, 50)));
         EXPECT_INT_RECT_EQ(IntRect(49, 49, 50, 50), occlusion.unoccludedContentRect(parent, IntRect(49, 49, 50, 50)));
@@ -592,7 +589,7 @@ protected:
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(51, 51, 50, 50)).isEmpty());
         EXPECT_TRUE(occlusion.unoccludedContentRect(parent, IntRect(50, 51, 50, 50)).isEmpty());
         EXPECT_INT_RECT_EQ(IntRect(49, 51, 1, 49), occlusion.unoccludedContentRect(parent, IntRect(49, 51, 50, 50)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
     }
 };
 
@@ -614,8 +611,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(child, this->identityMatrix, FloatPoint(10, 10), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer, occlusion);
         this->enterContributingSurface(child, occlusion);
@@ -625,20 +622,6 @@ protected:
         EXPECT_INT_RECT_EQ(IntRect(10, 430, 60, 70), occlusion.occlusionInTargetSurface().bounds());
         EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
 
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 430, 61, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 430, 60, 71)));
-
-        occlusion.useDefaultLayerScissorRect();
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 61, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 71)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
-
         this->leaveContributingSurface(child, occlusion);
         this->enterLayer(parent, occlusion);
 
@@ -653,13 +636,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(31, 40, 70, 60)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 41, 70, 60)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 40, 70, 60)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(29, 40, 70, 60)));
         EXPECT_FALSE(occlusion.occluded(parent, IntRect(30, 39, 70, 60)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(31, 40, 70, 60)));
         EXPECT_TRUE(occlusion.occluded(parent, IntRect(30, 41, 70, 60)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
 
         /* Justification for the above occlusion from |layer|:
@@ -710,8 +693,8 @@ protected:
         typename Types::ContentLayerType* child2 = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(30, 30), IntSize(60, 20), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(-10, -10, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-10, -10, 1000, 1000));
 
         this->visitLayer(child2, occlusion);
 
@@ -729,45 +712,10 @@ protected:
 
         this->enterContributingSurface(child, occlusion);
 
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(11, 430, 60, 70)));
-        EXPECT_FALSE(occlusion.occluded(child, IntRect(10, 431, 60, 70)));
-
-        occlusion.useDefaultLayerScissorRect();
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(9, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 429, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(11, 430, 60, 70)));
-        EXPECT_TRUE(occlusion.occluded(child, IntRect(10, 431, 60, 70)));
-        occlusion.setLayerScissorRect(IntRect(-10, -10, 1000, 1000));
-
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 430, 60, 70)).isEmpty());
-        // This is the little piece not occluded by child2
-        EXPECT_INT_RECT_EQ(IntRect(9, 430, 1, 10), occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 70)));
-        // This extends past both sides of child2, so it will be the original rect.
-        EXPECT_INT_RECT_EQ(IntRect(9, 430, 60, 80), occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 80)));
-        // This extends past two adjacent sides of child2, and should included the unoccluded parts of each side.
-        // This also demonstrates that the rect can be arbitrary and does not get clipped to the layer's visibleContentRect().
-        EXPECT_INT_RECT_EQ(IntRect(-10, 430, 20, 70), occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 70)));
-        // This extends past three adjacent sides of child2, so it should contain the unoccluded parts of each side. The left
-        // and bottom edges are completely unoccluded for some row/column so we get back the original query rect.
-        EXPECT_INT_RECT_EQ(IntRect(-10, 430, 60, 80), occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 80)));
-        EXPECT_INT_RECT_EQ(IntRect(10, 429, 60, 1), occlusion.unoccludedContentRect(child, IntRect(10, 429, 60, 70)));
-        EXPECT_INT_RECT_EQ(IntRect(70, 430, 1, 70), occlusion.unoccludedContentRect(child, IntRect(11, 430, 60, 70)));
-        EXPECT_INT_RECT_EQ(IntRect(10, 500, 60, 1), occlusion.unoccludedContentRect(child, IntRect(10, 431, 60, 70)));
-
-        occlusion.useDefaultLayerScissorRect();
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(9, 430, 60, 80)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(-10, 430, 60, 80)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 429, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(11, 430, 60, 70)).isEmpty());
-        EXPECT_TRUE(occlusion.unoccludedContentRect(child, IntRect(10, 431, 60, 70)).isEmpty());
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        EXPECT_INT_RECT_EQ(IntRect(30, 30, 70, 70), occlusion.occlusionInScreenSpace().bounds());
+        EXPECT_EQ(2u, occlusion.occlusionInScreenSpace().rects().size());
+        EXPECT_INT_RECT_EQ(IntRect(10, 430, 60, 70), occlusion.occlusionInTargetSurface().bounds());
+        EXPECT_EQ(1u, occlusion.occlusionInTargetSurface().rects().size());
 
         // Occlusion in |child2| should get merged with the |child| surface we are leaving now.
         this->leaveContributingSurface(child, occlusion);
@@ -856,8 +804,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(child, layerTransform, FloatPoint(0, 0), IntSize(500, 500), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         IntRect clippedLayerInChild = CCMathUtil::mapClippedRect(layerTransform, layer->visibleContentRect());
 
@@ -920,8 +868,8 @@ protected:
         typename Types::ContentLayerType* layer2 = this->createDrawingLayer(child, this->identityMatrix, FloatPoint(10, 450), IntSize(500, 60), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(layer2, occlusion);
         this->visitLayer(layer1, occlusion);
@@ -1008,8 +956,8 @@ protected:
         typename Types::ContentLayerType* layer2 = this->createDrawingLayer(child2, this->identityMatrix, FloatPoint(-10, -10), IntSize(510, 510), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(-20, -20, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-20, -20, 1000, 1000));
 
         this->visitLayer(layer2, occlusion);
         this->enterContributingSurface(child2, occlusion);
@@ -1025,13 +973,13 @@ protected:
         EXPECT_FALSE(occlusion.occluded(child2, IntRect(-10, 420, 71, 80)));
         EXPECT_FALSE(occlusion.occluded(child2, IntRect(-10, 420, 70, 81)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 420, 70, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-11, 420, 70, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 419, 70, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 420, 71, 80)));
         EXPECT_TRUE(occlusion.occluded(child2, IntRect(-10, 420, 70, 81)));
-        occlusion.setLayerScissorRect(IntRect(-20, -20, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-20, -20, 1000, 1000));
 
         // There is nothing above child2's surface in the z-order.
         EXPECT_INT_RECT_EQ(IntRect(-10, 420, 70, 80), occlusion.unoccludedContributingSurfaceContentRect(child2, false, IntRect(-10, 420, 70, 80)));
@@ -1122,8 +1070,8 @@ protected:
         typename Types::ContentLayerType* layer2 = this->createDrawingLayer(child2, this->identityMatrix, FloatPoint(-10, -10), IntSize(510, 510), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(-30, -30, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(-30, -30, 1000, 1000));
 
         this->visitLayer(layer2, occlusion);
         this->enterLayer(child2, occlusion);
@@ -1236,8 +1184,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // Opacity layer won't contribute to occlusion.
         this->visitLayer(opacityLayer, occlusion);
@@ -1300,8 +1248,8 @@ protected:
         this->createReplicaLayer(surface, this->identityMatrix, FloatPoint(50, 50), IntSize());
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
 
@@ -1331,8 +1279,8 @@ protected:
         this->createReplicaLayer(surface, this->identityMatrix, FloatPoint(50, 50), IntSize());
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
 
@@ -1363,8 +1311,8 @@ protected:
         this->createMaskLayer(replica, IntSize(10, 10));
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
 
@@ -1385,7 +1333,7 @@ protected:
 ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestReplicaWithMask);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1393,8 +1341,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(200, 100, 100, 100));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(200, 100, 100, 100));
 
         this->enterLayer(layer, occlusion);
 
@@ -1404,9 +1352,9 @@ protected:
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(100, 100, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
-        occlusion.setLayerScissorRect(IntRect(200, 100, 100, 100));
+        occlusion.setLayerClipRect(IntRect(200, 100, 100, 100));
 
         this->leaveLayer(layer, occlusion);
         this->visitContributingSurface(layer, occlusion);
@@ -1426,10 +1374,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectOutsideChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectOutsideChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectOutsideChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1437,8 +1385,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(200, 100, 100, 100));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(200, 100, 100, 100));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1448,9 +1396,9 @@ protected:
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(100, 100, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
 
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->leaveLayer(layer, occlusion);
         this->visitContributingSurface(layer, occlusion);
@@ -1470,10 +1418,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectOutsideChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectOutsideChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1481,8 +1429,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(100, 100, 100, 100));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(100, 100, 100, 100));
 
         this->enterLayer(layer, occlusion);
 
@@ -1509,10 +1457,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1520,8 +1468,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(100, 100, 100, 100));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(100, 100, 100, 100));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1548,10 +1496,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1559,8 +1507,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(50, 50, 200, 200));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(50, 50, 200, 200));
 
         this->enterLayer(layer, occlusion);
 
@@ -1591,10 +1539,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectPartlyOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectPartlyOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectPartlyOverChild : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1602,8 +1550,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(50, 50, 200, 200));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(50, 50, 200, 200));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1634,10 +1582,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectPartlyOverChild);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectPartlyOverChild);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1645,8 +1593,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(500, 500, 100, 100));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(500, 500, 100, 100));
 
         this->enterLayer(layer, occlusion);
 
@@ -1677,10 +1625,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectOverNothing);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectOverNothing);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestScreenScissorRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestViewportRectOverNothing : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1688,8 +1636,8 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(500, 500, 100, 100));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(500, 500, 100, 100));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->enterLayer(layer, occlusion);
 
@@ -1720,10 +1668,10 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestScreenScissorRectOverNothing);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestViewportRectOverNothing);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestLayerClipRectForLayerOffOrigin : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
@@ -1731,12 +1679,12 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
-        // This layer is translated when drawn into its target. So if the scissor rect given from the target surface
+        // This layer is translated when drawn into its target. So if the clip rect given from the target surface
         // is not in that target space, then after translating these query rects into the target, they will fall outside
-        // the scissor and be considered occluded.
+        // the clip and be considered occluded.
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(0, 0, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(0, 100, 100, 100)));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(100, 0, 100, 100)));
@@ -1744,7 +1692,7 @@ protected:
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerScissorRectForLayerOffOrigin);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestLayerClipRectForLayerOffOrigin);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestOpaqueContentsRegionEmpty : public CCOcclusionTrackerTest<Types, opaqueLayers> {
@@ -1755,7 +1703,7 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(200, 200), false);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(0, 0, 100, 100)));
@@ -1766,10 +1714,10 @@ protected:
         // Occluded since its outside the surface bounds.
         EXPECT_TRUE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
 
-        // Test without any scissors.
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        // Test without any clip rect.
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
         EXPECT_FALSE(occlusion.occluded(layer, IntRect(200, 100, 100, 100)));
-        occlusion.useDefaultLayerScissorRect();
+        occlusion.useDefaultLayerClipRect();
 
         this->leaveLayer(layer, occlusion);
         this->visitContributingSurface(layer, occlusion);
@@ -1792,7 +1740,7 @@ protected:
         this->calcDrawEtc(parent);
 
         {
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
             layer->setOpaqueContentsRect(IntRect(0, 0, 100, 100));
 
             this->resetLayerIterator();
@@ -1808,7 +1756,7 @@ protected:
         }
 
         {
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
             layer->setOpaqueContentsRect(IntRect(20, 20, 180, 180));
 
             this->resetLayerIterator();
@@ -1824,7 +1772,7 @@ protected:
         }
 
         {
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
             layer->setOpaqueContentsRect(IntRect(150, 150, 100, 100));
 
             this->resetLayerIterator();
@@ -1856,7 +1804,7 @@ protected:
         typename Types::ContentLayerType* layer = this->createDrawingLayer(container, transform, FloatPoint(100, 100), IntSize(200, 200), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         // The layer is rotated in 3d but without preserving 3d, so it only gets resized.
@@ -1890,7 +1838,7 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->visitLayer(child2, occlusion);
         EXPECT_TRUE(occlusion.occlusionInScreenSpace().isEmpty());
         EXPECT_TRUE(occlusion.occlusionInTargetSurface().isEmpty());
@@ -1922,7 +1870,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         EXPECT_INT_RECT_EQ(IntRect(0, 0, 200, 200), occlusion.unoccludedContentRect(layer, IntRect(0, 0, 200, 200)));
@@ -1953,7 +1901,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
         this->enterLayer(layer, occlusion);
 
         // The bottom 11 pixel rows of this layer remain visible inside the container, after translation to the target surface. When translated back,
@@ -1982,7 +1930,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         // The |layer| is entirely behind the camera and should not occlude.
         this->visitLayer(layer, occlusion);
@@ -2012,7 +1960,7 @@ protected:
         layer->setPreserves3D(true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         // This is very close to the camera, so pixels in its visibleContentRect will actually go outside of the layer's clipRect.
         // Ensure that those pixels don't occlude things outside the clipRect.
@@ -2049,7 +1997,7 @@ protected:
         EXPECT_FALSE(surface->drawOpacityIsAnimating());
         EXPECT_TRUE(surface->renderSurface()->drawOpacityIsAnimating());
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(topmost, occlusion);
         this->enterLayer(parent2, occlusion);
@@ -2101,7 +2049,7 @@ protected:
         EXPECT_FALSE(surface->drawOpacityIsAnimating());
         EXPECT_TRUE(surface->renderSurface()->drawOpacityIsAnimating());
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(topmost, occlusion);
         this->enterLayer(parent2, occlusion);
@@ -2159,7 +2107,7 @@ protected:
         EXPECT_TRUE(surfaceChild->drawTransformIsAnimating());
         EXPECT_TRUE(surfaceChild->screenSpaceTransformIsAnimating());
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface2, occlusion);
         this->enterContributingSurface(surface2, occlusion);
@@ -2241,7 +2189,7 @@ protected:
         surface2->setOpaqueContentsRect(IntRect(0, 0, 200, 200));
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface2, occlusion);
         this->visitContributingSurface(surface2, occlusion);
@@ -2277,7 +2225,7 @@ protected:
         surface->setOpaqueContentsRect(IntRect(0, 0, 400, 200));
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(surface, occlusion);
         this->visitContributingSurface(surface, occlusion);
@@ -2302,8 +2250,8 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 100), IntSize(100, 100), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // |topmost| occludes the replica, but not the surface itself.
         this->visitLayer(topmost, occlusion);
@@ -2340,8 +2288,8 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 110), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // |topmost| occludes the surface, but not the entire surface's replica.
         this->visitLayer(topmost, occlusion);
@@ -2380,8 +2328,8 @@ protected:
         typename Types::LayerType* overReplica = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 100), IntSize(50, 100), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // These occlude the surface and replica differently, so we can test each one.
         this->visitLayer(overReplica, occlusion);
@@ -2422,7 +2370,7 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 50), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(-100, -100, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(-100, -100, 1000, 1000));
 
         // |topmost| occludes everything partially so we know occlusion is happening at all.
         this->visitLayer(topmost, occlusion);
@@ -2468,19 +2416,19 @@ protected:
 ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestSurfaceChildOfSurface);
 
 template<class Types, bool opaqueLayers>
-class CCOcclusionTrackerTestTopmostSurfaceIsClippedToScissor : public CCOcclusionTrackerTest<Types, opaqueLayers> {
+class CCOcclusionTrackerTestTopmostSurfaceIsClippedToViewport : public CCOcclusionTrackerTest<Types, opaqueLayers> {
 protected:
     void runMyTest()
     {
-        // This test verifies that the top-most surface is considered occluded outside of its scissor rect and outside the screen's scissor rect.
+        // This test verifies that the top-most surface is considered occluded outside of its target's clipRect and outside the viewport rect.
 
         typename Types::ContentLayerType* parent = this->createRoot(this->identityMatrix, FloatPoint(0, 0), IntSize(100, 200));
         typename Types::LayerType* surface = this->createDrawingSurface(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 300), true);
         this->calcDrawEtc(parent);
 
         {
-            // Make a screen scissor rect that is larger than the root layer's.
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+            // Make a viewport rect that is larger than the root layer.
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
 
             this->visitLayer(surface, occlusion);
 
@@ -2491,20 +2439,20 @@ protected:
         }
         this->resetLayerIterator();
         {
-            // Make a screen scissor rect that is smaller than the root layer's.
-            TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 100, 100));
+            // Make a viewport rect that is smaller than the root layer.
+            TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 100, 100));
 
             this->visitLayer(surface, occlusion);
 
             // The root layer always has a clipRect. So the parent of |surface| has a clipRect giving the surface itself a clipRect.
             this->enterContributingSurface(surface, occlusion);
-            // Make sure the screen scissor rect clips the unoccluded region of the child surface.
+            // Make sure the viewport rect clips the unoccluded region of the child surface.
             EXPECT_INT_RECT_EQ(IntRect(0, 0, 100, 100), occlusion.unoccludedContributingSurfaceContentRect(surface, false, IntRect(0, 0, 100, 300)));
         }
     }
 };
 
-ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestTopmostSurfaceIsClippedToScissor);
+ALL_CCOCCLUSIONTRACKER_TEST(CCOcclusionTrackerTestTopmostSurfaceIsClippedToViewport);
 
 template<class Types, bool opaqueLayers>
 class CCOcclusionTrackerTestSurfaceChildOfClippingSurface : public CCOcclusionTrackerTest<Types, opaqueLayers> {
@@ -2519,8 +2467,8 @@ protected:
         typename Types::LayerType* topmost = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), IntSize(100, 50), true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // |topmost| occludes everything partially so we know occlusion is happening at all.
         this->visitLayer(topmost, occlusion);
@@ -2587,8 +2535,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // These layers occlude pixels directly beside the filteredSurface. Because filtered surface blends pixels in a radius, it will
         // need to see some of the pixels (up to radius far) underneath the occludingLayers.
@@ -2709,8 +2657,8 @@ protected:
 
         this->calcDrawEtc(root);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(occludingLayerAbove, occlusion);
         EXPECT_INT_RECT_EQ(IntRect(100 / 2, 100 / 2, 50 / 2, 50 / 2), occlusion.occlusionInScreenSpace().bounds());
@@ -2773,8 +2721,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // These layers occlude pixels directly beside the filteredSurface. Because filtered surface blends pixels in a radius, it will
         // need to see some of the pixels (up to radius far) underneath the occludingLayers.
@@ -2892,8 +2840,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         // The surface has a background blur, so it blurs non-opaque pixels below it.
         this->visitLayer(filteredSurface, occlusion);
@@ -2941,8 +2889,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(aboveReplicaLayer, occlusion);
         this->visitLayer(aboveSurfaceLayer, occlusion);
@@ -2995,8 +2943,8 @@ protected:
 
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
 
         this->visitLayer(besideReplicaLayer, occlusion);
         this->visitLayer(besideSurfaceLayer, occlusion);
@@ -3050,8 +2998,8 @@ protected:
         typename Types::LayerType* small = this->createDrawingLayer(parent, this->identityMatrix, FloatPoint(0, 0), belowTrackingSize, true);
         this->calcDrawEtc(parent);
 
-        TestCCOcclusionTrackerWithScissor<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
-        occlusion.setLayerScissorRect(IntRect(0, 0, 1000, 1000));
+        TestCCOcclusionTrackerWithClip<typename Types::LayerType, typename Types::RenderSurfaceType> occlusion(IntRect(0, 0, 1000, 1000));
+        occlusion.setLayerClipRect(IntRect(0, 0, 1000, 1000));
         occlusion.setMinimumTrackingSize(trackingSize);
 
         // The small layer is not tracked because it is too small.
diff --git a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
index 9eff157bc..8279a3a6b 100644
--- a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
@@ -27,6 +27,7 @@
 #include "cc/CCQuadCuller.h"
 
 #include "cc/CCLayerTilingData.h"
+#include "cc/CCMathUtil.h"
 #include "cc/CCOcclusionTracker.h"
 #include "cc/CCOverdrawMetrics.h"
 #include "cc/CCSingleThreadProxy.h"
@@ -80,6 +81,7 @@ static PassOwnPtr<CCTiledLayerImpl> makeLayer(CCTiledLayerImpl* parent, const We
             layer->pushTileProperties(i, j, resourceId++, tileOpaqueRect);
         }
 
+    IntRect rectInTarget = CCMathUtil::mapClippedRect(layer->drawTransform(), layer->visibleContentRect());
     if (!parent) {
         layer->createRenderSurface();
         surfaceLayerList.append(layer.get());
@@ -87,7 +89,9 @@ static PassOwnPtr<CCTiledLayerImpl> makeLayer(CCTiledLayerImpl* parent, const We
     } else {
         layer->setRenderTarget(parent->renderTarget());
         parent->renderSurface()->layerList().append(layer.get());
+        rectInTarget.unite(CCMathUtil::mapClippedRect(parent->drawTransform(), parent->visibleContentRect()));
     }
+    layer->setDrawableContentRect(rectInTarget);
 
     return layer.release();
 }
diff --git a/Source/WebKit/chromium/tests/CCRenderSurfaceFiltersTest.cpp b/Source/WebKit/chromium/tests/CCRenderSurfaceFiltersTest.cpp
new file mode 100644
index 000000000..b56a7fb42
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCRenderSurfaceFiltersTest.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCRenderSurfaceFilters.h"
+
+#include "CompositorFakeWebGraphicsContext3D.h"
+#include <gtest/gtest.h>
+#include <public/WebFilterOperation.h>
+#include <public/WebFilterOperations.h>
+#include <wtf/RefPtr.h>
+
+using namespace WebCore;
+using namespace WebKit;
+
+namespace {
+
+// Checks whether op can be combined with a following color matrix.
+bool isCombined(const WebFilterOperation& op)
+{
+    WebFilterOperations filters;
+    filters.append(op);
+    filters.append(WebFilterOperation::createBrightnessFilter(0)); // brightness(0) is identity.
+    WebFilterOperations optimized = CCRenderSurfaceFilters::optimize(filters);
+    return optimized.size() == 1;
+}
+
+TEST(CCRenderSurfaceFiltersTest, testColorMatrixFiltersCombined)
+{
+    // Several filters should always combine for any amount between 0 and 1:
+    // grayscale, saturate, invert, contrast, opacity.
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createGrayscaleFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSaturateFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createInvertFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createContrastFilter(1)));
+
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(0)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(0.3)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(0.5)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createOpacityFilter(1)));
+
+    // Several filters should never combine: brightness(amount > 0), blur, drop-shadow.
+    EXPECT_FALSE(isCombined(WebFilterOperation::createBrightnessFilter(0.5)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createBrightnessFilter(1)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createBlurFilter(3)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createDropShadowFilter(WebPoint(2, 2), 3, 0xffffffff)));
+
+    // sepia and hue may or may not combine depending on the value.
+    EXPECT_TRUE(isCombined(WebFilterOperation::createSepiaFilter(0)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createSepiaFilter(1)));
+    EXPECT_TRUE(isCombined(WebFilterOperation::createHueRotateFilter(0)));
+    EXPECT_FALSE(isCombined(WebFilterOperation::createHueRotateFilter(180)));
+
+    float matrix1[20] = {
+        1, 0, 0, 0, 0,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_TRUE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix1)));
+
+    float matrix2[20] = {
+        1, 1, 0, 0, 0,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_FALSE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix2)));
+
+    float matrix3[20] = {
+        0.25, 0, 0, 0, 255*0.75,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_TRUE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix3)));
+
+    float matrix4[20] = {
+        -0.25, 0.75, 0, 0, 255*0.25,
+        0, 1, 0, 0, 0,
+        0, 0, 1, 0, 0,
+        0, 0, 0, 1, 0,
+    };
+    EXPECT_TRUE(isCombined(WebFilterOperation::createColorMatrixFilter(matrix4)));
+}
+
+TEST(CCRenderSurfaceFiltersTest, testOptimize)
+{
+    WebFilterOperation combines(WebFilterOperation::createBrightnessFilter(0));
+    WebFilterOperation doesntCombine(WebFilterOperation::createBrightnessFilter(1));
+
+    WebFilterOperations filters;
+    WebFilterOperations optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(0u, optimized.size());
+
+    filters.append(combines);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(1u, optimized.size());
+
+    filters.append(combines);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(1u, optimized.size());
+
+    filters.append(doesntCombine);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(1u, optimized.size());
+
+    filters.append(combines);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(2u, optimized.size());
+
+    filters.append(doesntCombine);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(2u, optimized.size());
+
+    filters.append(doesntCombine);
+    optimized = CCRenderSurfaceFilters::optimize(filters);
+    EXPECT_EQ(3u, optimized.size());
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
index c95d71e84..ad8df2595 100644
--- a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
+++ b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
@@ -94,11 +94,16 @@ TEST(CCRenderSurfaceTest, sanityCheckSurfaceCreatesCorrectSharedQuadState)
     // This will fake that we are on the correct thread for testing purposes.
     DebugScopedSetImplThread setImplThread;
 
-    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(1);
+    OwnPtr<CCLayerImpl> rootLayer = CCLayerImpl::create(1);
+
+    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(2);
     owningLayer->createRenderSurface();
     ASSERT_TRUE(owningLayer->renderSurface());
+    owningLayer->setRenderTarget(owningLayer.get());
     CCRenderSurface* renderSurface = owningLayer->renderSurface();
 
+    rootLayer->addChild(owningLayer.release());
+
     IntRect contentRect = IntRect(IntPoint::zero(), IntSize(50, 50));
     IntRect clipRect = IntRect(IntPoint(5, 5), IntSize(40, 40));
     WebTransformationMatrix origin;
@@ -108,7 +113,6 @@ TEST(CCRenderSurfaceTest, sanityCheckSurfaceCreatesCorrectSharedQuadState)
     renderSurface->setDrawTransform(origin);
     renderSurface->setContentRect(contentRect);
     renderSurface->setClipRect(clipRect);
-    renderSurface->setScissorRect(clipRect);
     renderSurface->setDrawOpacity(1);
 
     OwnPtr<CCSharedQuadState> sharedQuadState = renderSurface->createSharedQuadState(0);
@@ -116,7 +120,6 @@ TEST(CCRenderSurfaceTest, sanityCheckSurfaceCreatesCorrectSharedQuadState)
     EXPECT_EQ(30, sharedQuadState->quadTransform.m41());
     EXPECT_EQ(40, sharedQuadState->quadTransform.m42());
     EXPECT_EQ(contentRect, IntRect(sharedQuadState->visibleContentRect));
-    EXPECT_EQ(clipRect, IntRect(sharedQuadState->scissorRect));
     EXPECT_EQ(1, sharedQuadState->opacity);
     EXPECT_FALSE(sharedQuadState->opaque);
 }
diff --git a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
index b2c41e525..42277459a 100644
--- a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
+++ b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
@@ -28,6 +28,7 @@
 
 #include "CompositorFakeWebGraphicsContext3D.h"
 #include "Extensions3DChromium.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
 #include <gtest/gtest.h>
@@ -188,7 +189,7 @@ private:
 class CCResourceProviderTest : public testing::Test {
 public:
     CCResourceProviderTest()
-        : m_context(CCGraphicsContext::create3D(ResourceProviderContext::create()))
+        : m_context(FakeWebCompositorOutputSurface::create(ResourceProviderContext::create()))
         , m_resourceProvider(CCResourceProvider::create(m_context.get()))
     {
     }
diff --git a/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h b/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h
index 6257ec888..beb16554d 100644
--- a/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCSchedulerTestCommon.h
@@ -52,6 +52,12 @@ public:
     {
         m_pendingTaskDelay = 0;
         m_pendingTask.clear();
+        m_runPendingTaskOnOverwrite = false;
+    }
+
+    void runPendingTaskOnOverwrite(bool enable)
+    {
+        m_runPendingTaskOnOverwrite = enable;
     }
 
     bool hasPendingTask() const { return m_pendingTask; }
@@ -71,6 +77,9 @@ public:
     virtual void postTask(PassOwnPtr<Task>) { ASSERT_NOT_REACHED(); }
     virtual void postDelayedTask(PassOwnPtr<Task> task, long long delay)
     {
+        if (m_runPendingTaskOnOverwrite && hasPendingTask())
+            runPendingTask();
+
         EXPECT_TRUE(!hasPendingTask());
         m_pendingTask = task;
         m_pendingTaskDelay = delay;
@@ -80,6 +89,7 @@ public:
 protected:
     OwnPtr<Task> m_pendingTask;
     long long m_pendingTaskDelay;
+    bool m_runPendingTaskOnOverwrite;
 };
 
 class FakeCCTimeSource : public WebCore::CCTimeSource {
@@ -93,6 +103,9 @@ public:
     virtual void setClient(WebCore::CCTimeSourceClient* client) OVERRIDE { m_client = client; }
     virtual void setActive(bool b) OVERRIDE { m_active = b; }
     virtual bool active() const OVERRIDE { return m_active; }
+    virtual void setTimebaseAndInterval(double timebase, double interval) OVERRIDE { }
+    virtual double lastTickTime() OVERRIDE { return 0; }
+    virtual double nextTickTime() OVERRIDE { return 0; }
 
     void tick()
     {
diff --git a/Source/WebKit/chromium/tests/CCScrollbarAnimationControllerLinearFadeTest.cpp b/Source/WebKit/chromium/tests/CCScrollbarAnimationControllerLinearFadeTest.cpp
new file mode 100644
index 000000000..e6cdc24c1
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCScrollbarAnimationControllerLinearFadeTest.cpp
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCScrollbarAnimationControllerLinearFade.h"
+
+#include "cc/CCScrollbarLayerImpl.h"
+#include "cc/CCSingleThreadProxy.h"
+#include <gtest/gtest.h>
+#include <wtf/OwnPtr.h>
+
+using namespace WebCore;
+
+namespace {
+
+class CCScrollbarAnimationControllerLinearFadeTest : public testing::Test {
+protected:
+    virtual void SetUp()
+    {
+        m_scrollLayer = CCLayerImpl::create(1);
+        m_scrollLayer->addChild(CCLayerImpl::create(2));
+        m_contentLayer = m_scrollLayer->children()[0].get();
+        m_scrollbarLayer = CCScrollbarLayerImpl::create(3);
+
+        m_scrollLayer->setMaxScrollPosition(IntSize(50, 50));
+        m_contentLayer->setBounds(IntSize(50, 50));
+
+        m_scrollbarController = CCScrollbarAnimationControllerLinearFade::create(m_scrollLayer.get(), 2, 3);
+        m_scrollbarController->setHorizontalScrollbarLayer(m_scrollbarLayer.get());
+    }
+
+    DebugScopedSetImplThread implThread;
+
+    OwnPtr<CCScrollbarAnimationControllerLinearFade> m_scrollbarController;
+    OwnPtr<CCLayerImpl> m_scrollLayer;
+    CCLayerImpl* m_contentLayer;
+    OwnPtr<CCScrollbarLayerImpl> m_scrollbarLayer;
+
+};
+
+TEST_F(CCScrollbarAnimationControllerLinearFadeTest, verifyHiddenInBegin)
+{
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 0);
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+}
+
+TEST_F(CCScrollbarAnimationControllerLinearFadeTest, verifyAwakenByScroll)
+{
+    m_scrollLayer->setScrollDelta(IntSize(1, 1));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 0);
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(1);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollLayer->setScrollDelta(IntSize(2, 2));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 1);
+    m_scrollbarController->animate(2);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(3);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(4);
+    EXPECT_FLOAT_EQ(2 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(5);
+    EXPECT_FLOAT_EQ(1 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollLayer->setScrollDelta(IntSize(3, 3));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 5);
+    m_scrollbarController->animate(6);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(7);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(8);
+    EXPECT_FLOAT_EQ(2 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(9);
+    EXPECT_FLOAT_EQ(1 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(10);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+}
+
+TEST_F(CCScrollbarAnimationControllerLinearFadeTest, verifyForceAwakenByPinch)
+{
+    m_scrollbarController->didPinchGestureBeginAtTime(0);
+    m_scrollbarController->didPinchGestureUpdateAtTime(0);
+    m_scrollbarController->animate(0);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(1);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollLayer->setScrollDelta(IntSize(1, 1));
+    m_scrollbarController->updateScrollOffsetAtTime(m_scrollLayer.get(), 1);
+    m_scrollbarController->animate(2);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(3);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(4);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(5);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(6);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->didPinchGestureEndAtTime(6);
+    m_scrollbarController->animate(7);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(8);
+    EXPECT_FLOAT_EQ(1, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(9);
+    EXPECT_FLOAT_EQ(2 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(10);
+    EXPECT_FLOAT_EQ(1 / 3.0, m_scrollbarLayer->opacity());
+    m_scrollbarController->animate(11);
+    EXPECT_FLOAT_EQ(0, m_scrollbarLayer->opacity());
+
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
index 1754a5b12..141a96328 100644
--- a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
@@ -51,6 +51,8 @@ TEST(CCSolidColorLayerImplTest, verifyTilingCompleteAndNoOverlap)
     layer->setVisibleContentRect(visibleContentRect);
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState(0);
     bool hadMissingTiles = false;
@@ -74,6 +76,8 @@ TEST(CCSolidColorLayerImplTest, verifyCorrectBackgroundColorInQuad)
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
     layer->setBackgroundColor(testColor);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState(0);
     bool hadMissingTiles = false;
@@ -98,6 +102,8 @@ TEST(CCSolidColorLayerImplTest, verifyCorrectOpacityInQuad)
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
     layer->setDrawOpacity(opacity);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     OwnPtr<CCSharedQuadState> sharedQuadState = layer->createSharedQuadState(0);
     bool hadMissingTiles = false;
diff --git a/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp b/Source/WebKit/chromium/tests/CCTextureUpdateControllerTest.cpp
index bfb35c048..a0dc2ec1f 100644
--- a/Source/WebKit/chromium/tests/CCTextureUpdaterTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTextureUpdateControllerTest.cpp
@@ -24,14 +24,15 @@
 
 #include "config.h"
 
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateController.h"
 
+#include "CCSchedulerTestCommon.h"
 #include "CCTiledLayerTestCommon.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
-#include "WebCompositor.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
-#include "platform/WebThread.h"
+#include <public/WebCompositor.h>
+#include <public/WebThread.h>
 
 #include <gtest/gtest.h>
 #include <wtf/RefPtr.h>
@@ -47,11 +48,11 @@ namespace {
 const int kFlushPeriodFull = 4;
 const int kFlushPeriodPartial = kFlushPeriodFull;
 
-class CCTextureUpdaterTest;
+class CCTextureUpdateControllerTest;
 
 class WebGraphicsContext3DForUploadTest : public FakeWebGraphicsContext3D {
 public:
-    WebGraphicsContext3DForUploadTest(CCTextureUpdaterTest *test)
+    WebGraphicsContext3DForUploadTest(CCTextureUpdateControllerTest *test)
         : m_test(test)
         , m_supportShallowFlush(true)
     { }
@@ -68,27 +69,23 @@ public:
     }
 
 private:
-    CCTextureUpdaterTest* m_test;
+    CCTextureUpdateControllerTest* m_test;
     bool m_supportShallowFlush;
 };
 
 
 class TextureUploaderForUploadTest : public FakeTextureUploader {
 public:
-    TextureUploaderForUploadTest(CCTextureUpdaterTest *test) : m_test(test) { }
+    TextureUploaderForUploadTest(CCTextureUpdateControllerTest *test) : m_test(test) { }
 
     virtual void beginUploads() OVERRIDE;
     virtual void endUploads() OVERRIDE;
-    virtual void uploadTexture(WebCore::LayerTextureUpdater::Texture*,
-                               WebCore::CCResourceProvider*,
-                               const WebCore::IntRect sourceRect,
-                               const WebCore::IntRect destRect) OVERRIDE;
+    virtual void uploadTexture(WebCore::CCResourceProvider*, Parameters) OVERRIDE;
 
 private:
-    CCTextureUpdaterTest* m_test;
+    CCTextureUpdateControllerTest* m_test;
 };
 
-
 class TextureForUploadTest : public LayerTextureUpdater::Texture {
 public:
     TextureForUploadTest() : LayerTextureUpdater::Texture(adoptPtr<CCPrioritizedTexture>(0)) { }
@@ -96,10 +93,11 @@ public:
 };
 
 
-class CCTextureUpdaterTest : public Test {
+class CCTextureUpdateControllerTest : public Test {
 public:
-    CCTextureUpdaterTest()
-    : m_uploader(this)
+    CCTextureUpdateControllerTest()
+    : m_queue(adoptPtr(new CCTextureUpdateQueue))
+    , m_uploader(this)
     , m_fullUploadCountExpected(0)
     , m_partialCountExpected(0)
     , m_totalUploadCountExpected(0)
@@ -176,8 +174,7 @@ protected:
         OwnPtr<WebThread> thread;
         WebCompositor::initialize(thread.get());
 
-        m_context = CCGraphicsContext::create3D(
-                    adoptPtr(new WebGraphicsContext3DForUploadTest(this)));
+        m_context = FakeWebCompositorOutputSurface::create(adoptPtr(new WebGraphicsContext3DForUploadTest(this)));
         DebugScopedSetImplThread implThread;
         m_resourceProvider = CCResourceProvider::create(m_context.get());
     }
@@ -187,24 +184,26 @@ protected:
         WebCompositor::shutdown();
     }
 
-    void appendFullUploadsToUpdater(int count)
+    void appendFullUploadsToUpdateQueue(int count)
     {
         m_fullUploadCountExpected += count;
         m_totalUploadCountExpected += count;
 
         const IntRect rect(0, 0, 300, 150);
+        const TextureUploader::Parameters upload = { &m_texture, rect, rect };
         for (int i = 0; i < count; i++)
-            m_updater.appendFullUpdate(&m_texture, rect, rect);
+            m_queue->appendFullUpload(upload);
     }
 
-    void appendPartialUploadsToUpdater(int count)
+    void appendPartialUploadsToUpdateQueue(int count)
     {
         m_partialCountExpected += count;
         m_totalUploadCountExpected += count;
 
         const IntRect rect(0, 0, 100, 100);
+        const TextureUploader::Parameters upload = { &m_texture, rect, rect };
         for (int i = 0; i < count; i++)
-            m_updater.appendPartialUpdate(&m_texture, rect, rect);
+            m_queue->appendPartialUpload(upload);
     }
 
     void setMaxUploadCountPerUpdate(int count)
@@ -213,10 +212,10 @@ protected:
     }
 
 protected:
-    // Classes required to interact and test the CCTextureUpdater
+    // Classes required to interact and test the CCTextureUpdateController
     OwnPtr<CCGraphicsContext> m_context;
     OwnPtr<CCResourceProvider> m_resourceProvider;
-    CCTextureUpdater m_updater;
+    OwnPtr<CCTextureUpdateQueue> m_queue;
     TextureForUploadTest m_texture;
     FakeTextureCopier m_copier;
     TextureUploaderForUploadTest m_uploader;
@@ -238,7 +237,6 @@ protected:
     int m_numPreviousFlushes;
 };
 
-
 void WebGraphicsContext3DForUploadTest::flush(void)
 {
     m_test->onFlush();
@@ -259,21 +257,18 @@ void TextureUploaderForUploadTest::endUploads()
     m_test->onEndUploads();
 }
 
-void TextureUploaderForUploadTest::uploadTexture(WebCore::LayerTextureUpdater::Texture* texture,
-                                                 WebCore::CCResourceProvider*,
-                                                 const WebCore::IntRect sourceRect,
-                                                 const WebCore::IntRect destRect)
+void TextureUploaderForUploadTest::uploadTexture(WebCore::CCResourceProvider*, Parameters)
 {
     m_test->onUpload();
 }
 
 
 // ZERO UPLOADS TESTS
-TEST_F(CCTextureUpdaterTest, ZeroUploads)
+TEST_F(CCTextureUpdateControllerTest, ZeroUploads)
 {
-    appendFullUploadsToUpdater(0);
-    appendPartialUploadsToUpdater(0);
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    appendFullUploadsToUpdateQueue(0);
+    appendPartialUploadsToUpdateQueue(0);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(0, m_numBeginUploads);
     EXPECT_EQ(0, m_numEndUploads);
@@ -283,12 +278,12 @@ TEST_F(CCTextureUpdaterTest, ZeroUploads)
 
 
 // ONE UPLOAD TESTS
-TEST_F(CCTextureUpdaterTest, OneFullUpload)
+TEST_F(CCTextureUpdateControllerTest, OneFullUpload)
 {
-    appendFullUploadsToUpdater(1);
-    appendPartialUploadsToUpdater(0);
+    appendFullUploadsToUpdateQueue(1);
+    appendPartialUploadsToUpdateQueue(0);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -296,12 +291,12 @@ TEST_F(CCTextureUpdaterTest, OneFullUpload)
     EXPECT_EQ(1, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, OnePartialUpload)
+TEST_F(CCTextureUpdateControllerTest, OnePartialUpload)
 {
-    appendFullUploadsToUpdater(0);
-    appendPartialUploadsToUpdater(1);
+    appendFullUploadsToUpdateQueue(0);
+    appendPartialUploadsToUpdateQueue(1);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -309,12 +304,12 @@ TEST_F(CCTextureUpdaterTest, OnePartialUpload)
     EXPECT_EQ(1, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, OneFullOnePartialUpload)
+TEST_F(CCTextureUpdateControllerTest, OneFullOnePartialUpload)
 {
-    appendFullUploadsToUpdater(1);
-    appendPartialUploadsToUpdater(1);
+    appendFullUploadsToUpdateQueue(1);
+    appendPartialUploadsToUpdateQueue(1);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     // We expect the full uploads to be followed by a flush
     // before the partial uploads begin.
@@ -333,12 +328,12 @@ const int fullNoRemainderCount = fullUploadFlushMultipler * kFlushPeriodFull;
 const int partialUploadFlushMultipler = 11;
 const int partialNoRemainderCount = partialUploadFlushMultipler * kFlushPeriodPartial;
 
-TEST_F(CCTextureUpdaterTest, ManyFullUploadsNoRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullUploadsNoRemainder)
 {
-    appendFullUploadsToUpdater(fullNoRemainderCount);
-    appendPartialUploadsToUpdater(0);
+    appendFullUploadsToUpdateQueue(fullNoRemainderCount);
+    appendPartialUploadsToUpdateQueue(0);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -346,12 +341,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullUploadsNoRemainder)
     EXPECT_EQ(fullNoRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyPartialUploadsNoRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyPartialUploadsNoRemainder)
 {
-    appendFullUploadsToUpdater(0);
-    appendPartialUploadsToUpdater(partialNoRemainderCount);
+    appendFullUploadsToUpdateQueue(0);
+    appendPartialUploadsToUpdateQueue(partialNoRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -359,12 +354,12 @@ TEST_F(CCTextureUpdaterTest, ManyPartialUploadsNoRemainder)
     EXPECT_EQ(partialNoRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullManyPartialUploadsNoRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullManyPartialUploadsNoRemainder)
 {
-    appendFullUploadsToUpdater(fullNoRemainderCount);
-    appendPartialUploadsToUpdater(partialNoRemainderCount);
+    appendFullUploadsToUpdateQueue(fullNoRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialNoRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -382,12 +377,12 @@ const int fullMaxRemainderCount = fullNoRemainderCount - 1;
 const int partialMinRemainderCount = partialNoRemainderCount + 1;
 const int partialMaxRemainderCount = partialNoRemainderCount - 1;
 
-TEST_F(CCTextureUpdaterTest, ManyFullAndPartialMinRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullAndPartialMinRemainder)
 {
-    appendFullUploadsToUpdater(fullMinRemainderCount);
-    appendPartialUploadsToUpdater(partialMinRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMinRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMinRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -395,12 +390,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullAndPartialMinRemainder)
     EXPECT_EQ(fullMinRemainderCount + partialMinRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullAndPartialUploadsMaxRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullAndPartialUploadsMaxRemainder)
 {
-    appendFullUploadsToUpdater(fullMaxRemainderCount);
-    appendPartialUploadsToUpdater(partialMaxRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMaxRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMaxRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -408,12 +403,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullAndPartialUploadsMaxRemainder)
     EXPECT_EQ(fullMaxRemainderCount + partialMaxRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullMinRemainderManyPartialMaxRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullMinRemainderManyPartialMaxRemainder)
 {
-    appendFullUploadsToUpdater(fullMinRemainderCount);
-    appendPartialUploadsToUpdater(partialMaxRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMinRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMaxRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -421,12 +416,12 @@ TEST_F(CCTextureUpdaterTest, ManyFullMinRemainderManyPartialMaxRemainder)
     EXPECT_EQ(fullMinRemainderCount + partialMaxRemainderCount, m_numPreviousUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, ManyFullMaxRemainderManyPartialMinRemainder)
+TEST_F(CCTextureUpdateControllerTest, ManyFullMaxRemainderManyPartialMinRemainder)
 {
-    appendFullUploadsToUpdater(fullMaxRemainderCount);
-    appendPartialUploadsToUpdater(partialMinRemainderCount);
+    appendFullUploadsToUpdateQueue(fullMaxRemainderCount);
+    appendPartialUploadsToUpdateQueue(partialMinRemainderCount);
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, m_totalUploadCountExpected);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), m_totalUploadCountExpected);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -444,7 +439,7 @@ int expectedFlushes(int uploads, int flushPeriod)
     return (uploads + flushPeriod - 1) / flushPeriod;
 }
 
-TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
+TEST_F(CCTextureUpdateControllerTest, TripleUpdateFinalUpdateFullAndPartial)
 {
     const int kMaxUploadsPerUpdate = 40;
     const int kFullUploads = 100;
@@ -454,12 +449,12 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     int expectedPreviousUploads = 0;
 
     setMaxUploadCountPerUpdate(kMaxUploadsPerUpdate);
-    appendFullUploadsToUpdater(kFullUploads);
-    appendPartialUploadsToUpdater(kPartialUploads);
+    appendFullUploadsToUpdateQueue(kFullUploads);
+    appendPartialUploadsToUpdateQueue(kPartialUploads);
 
     // First update (40 full)
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -471,7 +466,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     EXPECT_EQ(expectedPreviousUploads, m_numPreviousUploads);
 
     // Second update (40 full)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(2, m_numBeginUploads);
     EXPECT_EQ(2, m_numEndUploads);
@@ -483,7 +478,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     EXPECT_EQ(expectedPreviousUploads, m_numPreviousUploads);
 
     // Third update (20 full, 20 partial)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(3, m_numBeginUploads);
     EXPECT_EQ(3, m_numEndUploads);
@@ -499,7 +494,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateFullAndPartial)
     EXPECT_EQ(kFullUploads + kPartialUploads, m_numTotalUploads);
 }
 
-TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
+TEST_F(CCTextureUpdateControllerTest, TripleUpdateFinalUpdateAllPartial)
 {
     const int kMaxUploadsPerUpdate = 40;
     const int kFullUploads = 70;
@@ -509,12 +504,12 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     int expectedPreviousUploads = 0;
 
     setMaxUploadCountPerUpdate(kMaxUploadsPerUpdate);
-    appendFullUploadsToUpdater(kFullUploads);
-    appendPartialUploadsToUpdater(kPartialUploads);
+    appendFullUploadsToUpdateQueue(kFullUploads);
+    appendPartialUploadsToUpdateQueue(kPartialUploads);
 
     // First update (40 full)
     DebugScopedSetImplThread implThread;
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(1, m_numBeginUploads);
     EXPECT_EQ(1, m_numEndUploads);
@@ -526,7 +521,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     EXPECT_EQ(expectedPreviousUploads, m_numPreviousUploads);
 
     // Second update (30 full, optionally 10 partial)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(2, m_numBeginUploads);
     EXPECT_EQ(2, m_numEndUploads);
@@ -536,7 +531,7 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     // onFlush(), onUpload(), and onEndUpload() will do basic flush checks for us anyway.
 
     // Third update (30 partial OR 20 partial if 10 partial uploaded in second update)
-    m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, kMaxUploadsPerUpdate);
+    CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, m_queue.get(), kMaxUploadsPerUpdate);
 
     EXPECT_EQ(3, m_numBeginUploads);
     EXPECT_EQ(3, m_numEndUploads);
@@ -547,5 +542,4 @@ TEST_F(CCTextureUpdaterTest, TripleUpdateFinalUpdateAllPartial)
     EXPECT_EQ(kFullUploads + kPartialUploads, m_numTotalUploads);
 }
 
-
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCThreadedTest.cpp b/Source/WebKit/chromium/tests/CCThreadedTest.cpp
index 2e2c1a06f..89ff9cba3 100644
--- a/Source/WebKit/chromium/tests/CCThreadedTest.cpp
+++ b/Source/WebKit/chromium/tests/CCThreadedTest.cpp
@@ -26,31 +26,28 @@
 
 #include "CCThreadedTest.h"
 
-#include "AnimationIdVendor.h"
 #include "CCAnimationTestCommon.h"
 #include "CCOcclusionTrackerTestCommon.h"
 #include "CCTiledLayerTestCommon.h"
 #include "ContentLayerChromium.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
 #include "LayerChromium.h"
-#include "WebCompositor.h"
-#include "WebKit.h"
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCLayerAnimationController.h"
-#include "cc/CCLayerAnimationDelegate.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCScopedThreadProxy.h"
 #include "cc/CCSingleThreadProxy.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include "cc/CCThreadTask.h"
 #include "cc/CCTimingFunction.h"
-#include "platform/WebThread.h"
 #include <gmock/gmock.h>
 #include <public/Platform.h>
+#include <public/WebCompositor.h>
 #include <public/WebFilterOperation.h>
 #include <public/WebFilterOperations.h>
+#include <public/WebThread.h>
 #include <wtf/Locker.h>
 #include <wtf/MainThread.h>
 #include <wtf/PassRefPtr.h>
@@ -102,9 +99,9 @@ CompositorFakeWebGraphicsContext3DWithTextureTracking::CompositorFakeWebGraphics
 {
 }
 
-PassOwnPtr<WebGraphicsContext3D> TestHooks::createContext()
+PassOwnPtr<WebCompositorOutputSurface> TestHooks::createOutputSurface()
 {
-    return CompositorFakeWebGraphicsContext3DWithTextureTracking::create(WebGraphicsContext3D::Attributes());
+    return FakeWebCompositorOutputSurface::create(CompositorFakeWebGraphicsContext3DWithTextureTracking::create(WebGraphicsContext3D::Attributes()));
 }
 
 PassOwnPtr<MockLayerTreeHostImpl> MockLayerTreeHostImpl::create(TestHooks* testHooks, const CCLayerTreeSettings& settings, CCLayerTreeHostImplClient* client)
@@ -167,7 +164,7 @@ public:
         layerTreeHost->setRootLayer(rootLayer);
 
         // LayerTreeHostImpl won't draw if it has 1x1 viewport.
-        layerTreeHost->setViewportSize(IntSize(1, 1));
+        layerTreeHost->setViewportSize(IntSize(1, 1), IntSize(1, 1));
 
         layerTreeHost->rootLayer()->setLayerAnimationDelegate(testHooks);
 
@@ -226,9 +223,9 @@ public:
         m_testHooks->applyScrollAndScale(scrollDelta, scale);
     }
 
-    virtual PassOwnPtr<WebGraphicsContext3D> createContext3D() OVERRIDE
+    virtual PassOwnPtr<WebCompositorOutputSurface> createOutputSurface() OVERRIDE
     {
-        return m_testHooks->createContext();
+        return m_testHooks->createOutputSurface();
     }
 
     virtual void willCommit() OVERRIDE
@@ -249,9 +246,9 @@ public:
     {
     }
 
-    virtual void didRecreateContext(bool succeeded) OVERRIDE
+    virtual void didRecreateOutputSurface(bool succeeded) OVERRIDE
     {
-        m_testHooks->didRecreateContext(succeeded);
+        m_testHooks->didRecreateOutputSurface(succeeded);
     }
 
     virtual void scheduleComposite() OVERRIDE
diff --git a/Source/WebKit/chromium/tests/CCThreadedTest.h b/Source/WebKit/chromium/tests/CCThreadedTest.h
index 75886effe..946b65fd1 100644
--- a/Source/WebKit/chromium/tests/CCThreadedTest.h
+++ b/Source/WebKit/chromium/tests/CCThreadedTest.h
@@ -26,11 +26,11 @@
 #define CCThreadedTest_h
 
 #include "CompositorFakeWebGraphicsContext3D.h"
-#include "cc/CCLayerAnimationDelegate.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCScopedThreadProxy.h"
 #include <gtest/gtest.h>
+#include <public/WebAnimationDelegate.h>
 
 namespace WebCore {
 class CCLayerImpl;
@@ -47,7 +47,7 @@ class WebThread;
 namespace WebKitTests {
 
 // Used by test stubs to notify the test when something interesting happens.
-class TestHooks : public WebCore::CCLayerAnimationDelegate {
+class TestHooks : public WebKit::WebAnimationDelegate {
 public:
     virtual void beginCommitOnCCThread(WebCore::CCLayerTreeHostImpl*) { }
     virtual void commitCompleteOnCCThread(WebCore::CCLayerTreeHostImpl*) { }
@@ -58,17 +58,17 @@ public:
     virtual void applyScrollAndScale(const WebCore::IntSize&, float) { }
     virtual void updateAnimations(double monotonicTime) { }
     virtual void layout() { }
-    virtual void didRecreateContext(bool succeeded) { }
+    virtual void didRecreateOutputSurface(bool succeeded) { }
     virtual void didAddAnimation() { }
     virtual void didCommit() { }
     virtual void didCommitAndDrawFrame() { }
     virtual void scheduleComposite() { }
 
-    // Implementation of CCLayerAnimationDelegate
-    virtual void notifyAnimationStarted(double time) { }
-    virtual void notifyAnimationFinished(double time) { }
+    // Implementation of WebAnimationDelegate
+    virtual void notifyAnimationStarted(double time) OVERRIDE { }
+    virtual void notifyAnimationFinished(double time) OVERRIDE { }
 
-    virtual PassOwnPtr<WebKit::WebGraphicsContext3D> createContext();
+    virtual PassOwnPtr<WebKit::WebCompositorOutputSurface> createOutputSurface();
 };
 
 class TimeoutTask;
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
index a0850b251..8d3ca4219 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
@@ -52,6 +52,8 @@ static PassOwnPtr<CCTiledLayerImpl> createLayer(const IntSize& tileSize, const I
     layer->setDrawOpacity(1);
     layer->setBounds(layerSize);
     layer->setContentBounds(layerSize);
+    layer->createRenderSurface();
+    layer->setRenderTarget(layer.get());
 
     CCResourceProvider::ResourceId resourceId = 1;
     for (int i = 0; i < tiler->numTilesX(); ++i)
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
index ec2105327..54f29bbef 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
@@ -115,9 +115,9 @@ void FakeTiledLayerChromium::setNeedsDisplayRect(const FloatRect& rect)
     TiledLayerChromium::setNeedsDisplayRect(rect);
 }
 
-void FakeTiledLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+void FakeTiledLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
 {
-    updateContentRect(updater, visibleContentRect(), occlusion, stats);
+    updateContentRect(queue, visibleContentRect(), occlusion, stats);
 }
 
 void FakeTiledLayerChromium::setTexturePriorities(const CCPriorityCalculator& calculator)
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
index de1eb66c6..c75932acf 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
@@ -35,7 +35,7 @@
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCPrioritizedTexture.h"
 #include "cc/CCResourceProvider.h"
-#include "cc/CCTextureUpdater.h"
+#include "cc/CCTextureUpdateQueue.h"
 #include "cc/CCTiledLayerImpl.h"
 
 namespace WebKitTests {
@@ -122,7 +122,7 @@ public:
     const WebCore::FloatRect& lastNeedsDisplayRect() const { return m_lastNeedsDisplayRect; }
 
     // Updates the visibleContentRect().
-    virtual void update(WebCore::CCTextureUpdater&, const WebCore::CCOcclusionTracker*, WebCore::CCRenderingStats&) OVERRIDE;
+    virtual void update(WebCore::CCTextureUpdateQueue&, const WebCore::CCOcclusionTracker*, WebCore::CCRenderingStats&) OVERRIDE;
 
     virtual void setTexturePriorities(const WebCore::CCPriorityCalculator&) OVERRIDE;
 
@@ -153,7 +153,7 @@ protected:
 
 class FakeTextureCopier : public WebCore::TextureCopier {
 public:
-    virtual void copyTexture(unsigned, unsigned, const WebCore::IntSize&) { }
+    virtual void copyTexture(Parameters) { }
     virtual void flush() { }
 };
 
@@ -162,7 +162,7 @@ public:
     virtual bool isBusy() { return false; }
     virtual void beginUploads() { }
     virtual void endUploads() { }
-    virtual void uploadTexture(WebCore::LayerTextureUpdater::Texture* texture, WebCore::CCResourceProvider* resourceProvider, const WebCore::IntRect sourceRect, const WebCore::IntRect destRect) { texture->updateRect(resourceProvider, sourceRect, destRect); }
+    virtual void uploadTexture(WebCore::CCResourceProvider* resourceProvider, Parameters upload) { upload.texture->updateRect(resourceProvider, upload.sourceRect, upload.destRect); }
 };
 
 }
diff --git a/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp b/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp
index ace7410c3..fd72e96ed 100644
--- a/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp
+++ b/Source/WebKit/chromium/tests/Canvas2DLayerBridgeTest.cpp
@@ -26,17 +26,17 @@
 
 #include "Canvas2DLayerBridge.h"
 
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
 #include "GraphicsContext3DPrivate.h"
 #include "ImageBuffer.h"
 #include "LayerChromium.h"
-#include "WebCompositor.h"
-#include "WebKit.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCRenderingStats.h"
-#include "cc/CCTextureUpdater.h"
-#include "platform/WebKitPlatformSupport.h"
-#include "platform/WebThread.h"
+#include "cc/CCTextureUpdateQueue.h"
+#include <public/Platform.h>
+#include <public/WebCompositor.h>
+#include <public/WebThread.h>
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -75,7 +75,7 @@ protected:
     void fullLifecycleTest(ThreadMode threadMode, DeferralMode deferralMode)
     {
         RefPtr<GraphicsContext3D> mainContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext));
-        OwnPtr<CCGraphicsContext> ccImplContext = CCGraphicsContext::create3D(adoptPtr(new MockCanvasContext));
+        OwnPtr<CCGraphicsContext> ccImplContext = FakeWebCompositorOutputSurface::create(adoptPtr(new MockCanvasContext));
 
         MockCanvasContext& mainMock = *static_cast<MockCanvasContext*>(GraphicsContext3DPrivate::extractWebGraphicsContext3D(mainContext.get()));
         MockCanvasContext& implMock = *static_cast<MockCanvasContext*>(ccImplContext->context3D());
@@ -143,17 +143,4 @@ TEST_F(Canvas2DLayerBridgeTest, testFullLifecycleThreadedDeferred)
     fullLifecycleTest(Threaded, Deferred);
 }
 
-TEST(Canvas2DLayerBridgeTest2, testClearClient)
-{
-    GraphicsContext3D::Attributes attrs;
-
-    RefPtr<GraphicsContext3D> mainContext = GraphicsContext3DPrivate::createGraphicsContextFromWebContext(adoptPtr(new MockCanvasContext));
-    OwnPtr<Canvas2DLayerBridge> bridge = Canvas2DLayerBridge::create(mainContext.get(), IntSize(100, 100), Deferred, 1);
-    RefPtr<LayerChromium> layer = bridge->layer();
-    bridge.clear();
-    CCTextureUpdater updater;
-    CCRenderingStats stats;
-    layer->update(updater, 0, stats);
-}
-
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h b/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h
index 0790639d5..469e25c31 100644
--- a/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/CompositorFakeWebGraphicsContext3D.h
@@ -26,6 +26,7 @@
 #define CompositorFakeWebGraphicsContext3D_h
 
 #include "FakeWebGraphicsContext3D.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebKit {
 
diff --git a/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h b/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h
index beb4ef366..33c4b3046 100644
--- a/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h
+++ b/Source/WebKit/chromium/tests/FakeCCGraphicsContext.h
@@ -27,13 +27,15 @@
 #define FakeCCGraphicsContext_h
 
 #include "CompositorFakeWebGraphicsContext3D.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "cc/CCGraphicsContext.h"
+#include <public/WebCompositorOutputSurface.h>
 
 namespace WebKit {
 
 static inline PassOwnPtr<WebCore::CCGraphicsContext> createFakeCCGraphicsContext()
 {
-    return WebCore::CCGraphicsContext::create3D(CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()));
+    return FakeWebCompositorOutputSurface::create(CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()));
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h b/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
index 0b3c3fe9e..84804da96 100755
--- a/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
+++ b/Source/WebKit/chromium/tests/FakeCCLayerTreeHostClient.h
@@ -28,6 +28,8 @@
 #include "config.h"
 
 #include "CompositorFakeWebGraphicsContext3D.h"
+#include "FakeWebCompositorOutputSurface.h"
+
 #include "cc/CCLayerTreeHost.h"
 
 namespace WebCore {
@@ -39,12 +41,13 @@ public:
     virtual void updateAnimations(double monotonicFrameBeginTime) OVERRIDE { }
     virtual void layout() OVERRIDE { }
     virtual void applyScrollAndScale(const IntSize& scrollDelta, float pageScale) OVERRIDE { }
-    virtual PassOwnPtr<WebKit::WebGraphicsContext3D> createContext3D() OVERRIDE
+
+    virtual PassOwnPtr<WebKit::WebCompositorOutputSurface> createOutputSurface() OVERRIDE
     {
         WebKit::WebGraphicsContext3D::Attributes attrs;
-        return WebKit::CompositorFakeWebGraphicsContext3D::create(WebKit::WebGraphicsContext3D::Attributes());
+        return WebKit::FakeWebCompositorOutputSurface::create(WebKit::CompositorFakeWebGraphicsContext3D::create(attrs));
     }
-    virtual void didRecreateContext(bool success) OVERRIDE { }
+    virtual void didRecreateOutputSurface(bool success) OVERRIDE { }
     virtual void willCommit() OVERRIDE { }
     virtual void didCommit() OVERRIDE { }
     virtual void didCommitAndDrawFrame() OVERRIDE { }
diff --git a/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp b/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
index 720630e17..afffc1623 100644
--- a/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
+++ b/Source/WebKit/chromium/tests/FakeGraphicsContext3DTest.cpp
@@ -26,9 +26,10 @@
 #include "config.h"
 
 #include "FakeWebGraphicsContext3D.h"
-
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 using namespace WebCore;
 using namespace WebKit;
diff --git a/Source/WebKit/chromium/src/ColorChooserProxy.h b/Source/WebKit/chromium/tests/FakeWebCompositorOutputSurface.h
index 987f67b3c..c20c9f991 100644
--- a/Source/WebKit/chromium/src/ColorChooserProxy.h
+++ b/Source/WebKit/chromium/tests/FakeWebCompositorOutputSurface.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,56 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ColorChooserProxy_h
-#define ColorChooserProxy_h
+#ifndef FakeWebCompositorOutputSurface_h
+#define FakeWebCompositorOutputSurface_h
 
-#include "ColorChooser.h"
-#include "WebColorChooser.h"
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-
-#if ENABLE(INPUT_TYPE_COLOR)
+#include <public/WebCompositorOutputSurface.h>
+#include <public/WebGraphicsContext3D.h>
 
 namespace WebKit {
 
-class ColorChooserProxy : public WebCore::ColorChooser {
+class FakeWebCompositorOutputSurface : public WebCompositorOutputSurface {
 public:
-    ColorChooserProxy(PassOwnPtr<WebColorChooser>);
-    virtual ~ColorChooserProxy();
+    static inline PassOwnPtr<FakeWebCompositorOutputSurface> create(PassOwnPtr<WebGraphicsContext3D> context3D)
+    {
+        return adoptPtr(new FakeWebCompositorOutputSurface(context3D));
+    }
+
+
+    virtual bool bindToClient(WebCompositorOutputSurfaceClient* client) OVERRIDE
+    {
+        ASSERT(client);
+        if (!m_context3D->makeContextCurrent())
+            return false;
+        m_client = client;
+        return true;
+    }
+
+    virtual const Capabilities& capabilities() const OVERRIDE
+    {
+        return m_capabilities;
+    }
 
-    virtual void setSelectedColor(const WebCore::Color&);
-    virtual void endChooser();
+    virtual WebGraphicsContext3D* context3D() const OVERRIDE
+    {
+        return m_context3D.get();
+    }
+
+    virtual void sendFrameToParentCompositor(const WebCompositorFrame&) OVERRIDE
+    {
+    }
 
 private:
-    OwnPtr<WebColorChooser> m_chooser;
+    explicit FakeWebCompositorOutputSurface(PassOwnPtr<WebGraphicsContext3D> context3D)
+    {
+        m_context3D = context3D;
+    }
+
+    OwnPtr<WebGraphicsContext3D> m_context3D;
+    Capabilities m_capabilities;
+    WebCompositorOutputSurfaceClient* m_client;
 };
 
 } // namespace WebKit
 
-#endif // ENABLE(INPUT_TYPE_COLOR)
-
-#endif // ColorChooserProxy_h
+#endif // FakeWebCompositorOutputSurface_h
diff --git a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
index b864c35fd..bd3545f45 100644
--- a/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
+++ b/Source/WebKit/chromium/tests/FakeWebGraphicsContext3D.h
@@ -27,7 +27,7 @@
 #define FakeWebGraphicsContext3D_h
 
 #include "GraphicsContext3D.h"
-#include "platform/WebGraphicsContext3D.h"
+#include <public/WebGraphicsContext3D.h>
 
 namespace WebKit {
 
diff --git a/Source/WebKit/chromium/tests/FakeWebScrollbarThemeGeometry.h b/Source/WebKit/chromium/tests/FakeWebScrollbarThemeGeometry.h
new file mode 100644
index 000000000..0ca5436f2
--- /dev/null
+++ b/Source/WebKit/chromium/tests/FakeWebScrollbarThemeGeometry.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FakeWebScrollbarThemeGeometry_h
+#define FakeWebScrollbarThemeGeometry_h
+
+#include <public/WebScrollbarThemeGeometry.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+class FakeWebScrollbarThemeGeometry : public WebKit::WebScrollbarThemeGeometry {
+public:
+    static PassOwnPtr<WebKit::WebScrollbarThemeGeometry> create() { return adoptPtr(new WebKit::FakeWebScrollbarThemeGeometry()); }
+
+    virtual WebKit::WebScrollbarThemeGeometry* clone() const OVERRIDE
+    {
+        return new FakeWebScrollbarThemeGeometry();
+    }
+
+    virtual int thumbPosition(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int thumbLength(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int trackPosition(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int trackLength(WebScrollbar*) OVERRIDE { return 0; }
+    virtual bool hasButtons(WebScrollbar*) OVERRIDE { return false; }
+    virtual bool hasThumb(WebScrollbar*) OVERRIDE { return false; }
+    virtual WebRect trackRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect thumbRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual int minimumThumbLength(WebScrollbar*) OVERRIDE { return 0; }
+    virtual int scrollbarThickness(WebScrollbar*) OVERRIDE { return 0; }
+    virtual WebRect backButtonStartRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect backButtonEndRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect forwardButtonStartRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect forwardButtonEndRect(WebScrollbar*) OVERRIDE { return WebRect(); }
+    virtual WebRect constrainTrackRectToTrackPieces(WebScrollbar*, const WebRect&) OVERRIDE { return WebRect(); }
+
+    virtual void splitTrack(WebScrollbar*, const WebRect& track, WebRect& startTrack, WebRect& thumb, WebRect& endTrack) OVERRIDE
+    {
+        startTrack = WebRect();
+        thumb = WebRect();
+        endTrack = WebRect();
+    }
+};
+
+} // namespace WebKit
+
+#endif // FakeWebScrollbarThemeGeometry_h
diff --git a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
index 91aeb7ca5..21d0705b8 100644
--- a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
@@ -36,11 +36,10 @@
 #include "Matrix3DTransformOperation.h"
 #include "RotateTransformOperation.h"
 #include "TranslateTransformOperation.h"
-#include "WebCompositor.h"
-
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCSingleThreadProxy.h"
+#include <public/WebCompositor.h>
 
 #include <gtest/gtest.h>
 #include <public/WebGraphicsContext3D.h>
@@ -71,7 +70,7 @@ public:
         bool success = layerTreeHost->initialize();
         EXPECT_TRUE(success);
         layerTreeHost->setRootLayer(LayerChromium::create());
-        layerTreeHost->setViewportSize(IntSize(1, 1));
+        layerTreeHost->setViewportSize(IntSize(1, 1), IntSize(1, 1));
         return layerTreeHost.release();
     }
 
@@ -95,7 +94,7 @@ public:
         WebCompositor::setAcceleratedAnimationEnabled(true);
         WebCompositor::initialize(0);
         m_graphicsLayer = static_pointer_cast<GraphicsLayerChromium>(GraphicsLayer::create(&m_client));
-        m_platformLayer = static_cast<LayerChromium*>(m_graphicsLayer->platformLayer());
+        m_platformLayer = m_graphicsLayer->platformLayer()->unwrap<LayerChromium>();
         m_layerTreeHost = MockLayerTreeHost::create();
         m_platformLayer->setLayerTreeHost(m_layerTreeHost.get());
     }
@@ -133,7 +132,7 @@ TEST_F(GraphicsLayerChromiumTest, updateLayerPreserves3DWithAnimations)
 
     m_graphicsLayer->setPreserves3D(true);
 
-    m_platformLayer = static_cast<LayerChromium*>(m_graphicsLayer->platformLayer());
+    m_platformLayer = m_graphicsLayer->platformLayer()->unwrap<LayerChromium>();
     ASSERT_TRUE(m_platformLayer);
 
     ASSERT_TRUE(m_platformLayer->hasActiveAnimation());
@@ -142,7 +141,7 @@ TEST_F(GraphicsLayerChromiumTest, updateLayerPreserves3DWithAnimations)
 
     m_graphicsLayer->setPreserves3D(false);
 
-    m_platformLayer = static_cast<LayerChromium*>(m_graphicsLayer->platformLayer());
+    m_platformLayer = m_graphicsLayer->platformLayer()->unwrap<LayerChromium>();
     ASSERT_TRUE(m_platformLayer);
 
     ASSERT_FALSE(m_platformLayer->hasActiveAnimation());
diff --git a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
index d9e3d697b..91df126a5 100644
--- a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
@@ -74,7 +74,7 @@ public:
     {
         return adoptRef(new FailingBackingStore);
     }
-    virtual bool createIDBDatabaseMetaData(const String&, const String&, int64_t&)
+    virtual bool createIDBDatabaseMetaData(const String&, const String&, int64_t, int64_t&)
     {
         return false;
     }
diff --git a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
index 536d785b9..8862b58d4 100644
--- a/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
+++ b/Source/WebKit/chromium/tests/IDBFakeBackingStore.h
@@ -33,9 +33,10 @@ namespace WebCore {
 class IDBFakeBackingStore : public IDBBackingStore {
 public:
     virtual void getDatabaseNames(Vector<String>& foundNames) OVERRIDE { }
-    virtual bool getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId) OVERRIDE { return false; }
-    virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId) OVERRIDE { return true; }
+    virtual bool getIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundIntVersion, int64_t& foundId) OVERRIDE { return false; }
+    virtual bool createIDBDatabaseMetaData(const String& name, const String& version, int64_t intVersion, int64_t& rowId) OVERRIDE { return true; }
     virtual bool updateIDBDatabaseMetaData(int64_t rowId, const String& version) OVERRIDE { return false; }
+    virtual bool updateIDBDatabaseIntVersion(int64_t rowId, int64_t version) OVERRIDE { return false; }
     virtual bool deleteDatabase(const String& name) OVERRIDE { return false; }
 
     virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<IDBKeyPath>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags) OVERRIDE { }
diff --git a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
index 137699c30..1b2ff6fe1 100644
--- a/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBLevelDBCodingTest.cpp
@@ -84,6 +84,24 @@ TEST(IDBLevelDBCodingTest, EncodeByte)
     EXPECT_EQ(expected, encodeByte(c));
 }
 
+TEST(IDBLevelDBCodingTest, DecodeByte)
+{
+    Vector<unsigned char> testCases;
+    testCases.append(0);
+    testCases.append(1);
+    testCases.append(255);
+
+    for (size_t i = 0; i < testCases.size(); ++i) {
+        unsigned char n = testCases[i];
+        Vector<char> v = encodeByte(n);
+
+        unsigned char res;
+        const char* p = decodeByte(v.data(), v.data() + v.size(), res);
+        EXPECT_EQ(n, res);
+        EXPECT_EQ(v.data() + v.size(), p);
+    }
+}
+   
 TEST(IDBLevelDBCodingTest, EncodeBool)
 {
     {
@@ -187,8 +205,10 @@ TEST(IDBLevelDBCodingTest, EncodeVarInt)
     EXPECT_EQ(static_cast<size_t>(2), encodeVarInt(255).size());
     EXPECT_EQ(static_cast<size_t>(2), encodeVarInt(256).size());
     EXPECT_EQ(static_cast<size_t>(5), encodeVarInt(0xffffffff).size());
+    EXPECT_EQ(static_cast<size_t>(8), encodeVarInt(0xfffffffffffffLL).size());
+    EXPECT_EQ(static_cast<size_t>(9), encodeVarInt(0x7fffffffffffffffLL).size());
 #ifdef NDEBUG
-    EXPECT_EQ(static_cast<size_t>(8), encodeInt(-100).size());
+    EXPECT_EQ(static_cast<size_t>(10), encodeVarInt(-100).size());
 #endif
 }
 
@@ -682,6 +702,24 @@ TEST(IDBLevelDBCodingTest, ComparisonTest)
     }
 }
 
+TEST(IDBLevelDBCodingTest, EncodeVarIntVSEncodeByteTest)
+{
+    Vector<unsigned char> testCases;
+    testCases.append(0);
+    testCases.append(1);
+    testCases.append(127);
+
+    for (size_t i = 0; i < testCases.size(); ++i) {
+        unsigned char n = testCases[i];
+
+        Vector<char> vA = encodeByte(n);
+        Vector<char> vB = encodeVarInt(static_cast<int64_t>(n));
+
+        EXPECT_EQ(vA.size(), vB.size());
+        EXPECT_EQ(*(vA.data()), *(vB.data()));
+    }
+}
+
 } // namespace
 
 #endif // USE(LEVELDB)
diff --git a/Source/WebKit/chromium/public/platform/WebContentLayerClient.h b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
index 8f1ca3324..0f3b77527 100644
--- a/Source/WebKit/chromium/public/platform/WebContentLayerClient.h
+++ b/Source/WebKit/chromium/tests/IDBRequestTest.cpp
@@ -23,4 +23,42 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "../../../../Platform/chromium/public/WebContentLayerClient.h"
+#include "config.h"
+
+#include "IDBRequest.h"
+
+#include "IDBCursorBackendInterface.h"
+#include "IDBDatabaseBackendImpl.h"
+#include "IDBTransactionCoordinator.h"
+
+#include <gtest/gtest.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+using namespace WebCore;
+
+namespace {
+
+TEST(IDBRequestTest, EventsAfterStopping)
+{
+    ScriptExecutionContext* context = 0;
+    IDBTransaction* transaction = 0;
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::createInvalid(), transaction);
+    EXPECT_EQ(request->readyState(), "pending");
+    request->stop();
+
+    // Ensure none of the following raise assertions in stopped state:
+    request->onError(IDBDatabaseError::create(IDBDatabaseException::IDB_ABORT_ERR, "Description goes here."));
+    request->onSuccess(DOMStringList::create());
+    request->onSuccess(PassRefPtr<IDBDatabaseBackendInterface>());
+    request->onSuccess(PassRefPtr<IDBCursorBackendInterface>());
+    request->onSuccess(IDBKey::createInvalid());
+    request->onSuccess(PassRefPtr<IDBTransactionBackendInterface>());
+    request->onSuccess(SerializedScriptValue::nullValue());
+    request->onSuccess(SerializedScriptValue::nullValue(), IDBKey::createInvalid(), IDBKeyPath());
+    request->onSuccessWithContinuation();
+}
+
+} // namespace
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
index a932ab61c..1a14d75bc 100644
--- a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
@@ -29,13 +29,12 @@
 #include "CCLayerTreeTestCommon.h"
 #include "FakeCCLayerTreeHostClient.h"
 #include "LayerPainterChromium.h"
-#include "NonCompositedContentHost.h"
-#include "WebCompositor.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <public/WebCompositor.h>
 #include <public/WebTransformationMatrix.h>
 
 using namespace WebCore;
@@ -495,7 +494,7 @@ TEST_F(LayerChromiumTest, checkPropertyChangeCausesCorrectBehavior)
 
     // Test properties that should not call needsDisplay and needsCommit when changed.
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setVisibleContentRect(IntRect(0, 0, 40, 50)));
-    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setIsNonCompositedContent(true));
+    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setUseLCDText(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setDrawOpacity(0.5));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setRenderTarget(0));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(0, testLayer->setDrawTransform(WebTransformationMatrix()));
diff --git a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
index d861164f6..c4bddc5fb 100644
--- a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
@@ -26,13 +26,14 @@
 #include "LayerRendererChromium.h"
 
 #include "CCTestCommon.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include "FakeWebGraphicsContext3D.h"
 #include "GraphicsContext3D.h"
-#include "WebCompositor.h"
 #include "cc/CCDrawQuad.h"
 #include "cc/CCPrioritizedTextureManager.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
+#include <public/WebCompositor.h>
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -128,7 +129,7 @@ protected:
     LayerRendererChromiumTest()
         : m_suggestHaveBackbufferYes(1, true)
         , m_suggestHaveBackbufferNo(1, false)
-        , m_context(CCGraphicsContext::create3D(adoptPtr(new FrameCountingMemoryAllocationSettingContext())))
+        , m_context(FakeWebCompositorOutputSurface::create(adoptPtr(new FrameCountingMemoryAllocationSettingContext())))
         , m_resourceProvider(CCResourceProvider::create(m_context.get()))
         , m_layerRendererChromium(&m_mockClient, m_resourceProvider.get())
     {
@@ -147,7 +148,7 @@ protected:
 
     void swapBuffers()
     {
-        m_layerRendererChromium.swapBuffers(IntRect());
+        m_layerRendererChromium.swapBuffers();
     }
 
     FrameCountingMemoryAllocationSettingContext* context() { return static_cast<FrameCountingMemoryAllocationSettingContext*>(m_context->context3D()); }
@@ -224,7 +225,7 @@ TEST_F(LayerRendererChromiumTest, DiscardedBackbufferIsRecreatedForScopeDuration
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
 
     m_layerRendererChromium.setVisible(true);
-    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses(), FloatRect());
+    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses());
     EXPECT_FALSE(m_layerRendererChromium.isFramebufferDiscarded());
 
     swapBuffers();
@@ -239,7 +240,7 @@ TEST_F(LayerRendererChromiumTest, FramebufferDiscardedAfterReadbackWhenNotVisibl
     EXPECT_EQ(1, m_mockClient.setFullRootLayerDamageCount());
 
     char pixels[4];
-    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses(), FloatRect());
+    m_layerRendererChromium.drawFrame(m_mockClient.renderPassesInDrawOrder(), m_mockClient.renderPasses());
     EXPECT_FALSE(m_layerRendererChromium.isFramebufferDiscarded());
 
     m_layerRendererChromium.getFramebufferPixels(pixels, IntRect(0, 0, 1, 1));
@@ -318,7 +319,7 @@ TEST(LayerRendererChromiumTest2, initializationDoesNotMakeSynchronousCalls)
 {
     CCScopedSettings scopedSettings;
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> context(CCGraphicsContext::create3D(adoptPtr(new ForbidSynchronousCallContext)));
+    OwnPtr<CCGraphicsContext> context(FakeWebCompositorOutputSurface::create(adoptPtr(new ForbidSynchronousCallContext)));
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(context.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
 
@@ -362,7 +363,7 @@ TEST(LayerRendererChromiumTest2, initializationWithQuicklyLostContextDoesNotAsse
 {
     CCScopedSettings scopedSettings;
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> context(CCGraphicsContext::create3D(adoptPtr(new LoseContextOnFirstGetContext)));
+    OwnPtr<CCGraphicsContext> context(FakeWebCompositorOutputSurface::create(adoptPtr(new LoseContextOnFirstGetContext)));
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(context.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
 
@@ -384,7 +385,7 @@ public:
 TEST(LayerRendererChromiumTest2, initializationWithoutGpuMemoryManagerExtensionSupportShouldDefaultToNonZeroAllocation)
 {
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> context(CCGraphicsContext::create3D(adoptPtr(new ContextThatDoesNotSupportMemoryManagmentExtensions)));
+    OwnPtr<CCGraphicsContext> context(FakeWebCompositorOutputSurface::create(adoptPtr(new ContextThatDoesNotSupportMemoryManagmentExtensions)));
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(context.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
 
@@ -411,7 +412,7 @@ private:
 TEST(LayerRendererChromiumTest2, opaqueBackground)
 {
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> ccContext(CCGraphicsContext::create3D(adoptPtr(new ClearCountingContext)));
+    OwnPtr<CCGraphicsContext> ccContext(FakeWebCompositorOutputSurface::create(adoptPtr(new ClearCountingContext)));
     ClearCountingContext* context = static_cast<ClearCountingContext*>(ccContext->context3D());
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(ccContext.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
@@ -420,7 +421,7 @@ TEST(LayerRendererChromiumTest2, opaqueBackground)
 
     EXPECT_TRUE(layerRendererChromium.initialize());
 
-    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses(), FloatRect());
+    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses());
 
     // On DEBUG builds, render passes with opaque background clear to blue to
     // easily see regions that were not drawn on the screen.
@@ -434,7 +435,7 @@ TEST(LayerRendererChromiumTest2, opaqueBackground)
 TEST(LayerRendererChromiumTest2, transparentBackground)
 {
     FakeCCRendererClient mockClient;
-    OwnPtr<CCGraphicsContext> ccContext(CCGraphicsContext::create3D(adoptPtr(new ClearCountingContext)));
+    OwnPtr<CCGraphicsContext> ccContext(FakeWebCompositorOutputSurface::create(adoptPtr(new ClearCountingContext)));
     ClearCountingContext* context = static_cast<ClearCountingContext*>(ccContext->context3D());
     OwnPtr<CCResourceProvider> resourceProvider(CCResourceProvider::create(ccContext.get()));
     FakeLayerRendererChromium layerRendererChromium(&mockClient, resourceProvider.get());
@@ -443,7 +444,7 @@ TEST(LayerRendererChromiumTest2, transparentBackground)
 
     EXPECT_TRUE(layerRendererChromium.initialize());
 
-    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses(), FloatRect());
+    layerRendererChromium.drawFrame(mockClient.renderPassesInDrawOrder(), mockClient.renderPasses());
 
     EXPECT_EQ(1, context->clearCount());
 }
diff --git a/Source/WebKit/chromium/tests/LocaleMacTest.cpp b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
index 1150a301a..f6b0f6292 100644
--- a/Source/WebKit/chromium/tests/LocaleMacTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
@@ -118,6 +118,12 @@ protected:
         OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
         return locale->timeAMPMLabels()[index];
     }
+
+    String decimalSeparator(const String& localeString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->localizedDecimalSeparator();
+    }
 #endif
 };
 
@@ -207,4 +213,44 @@ TEST_F(LocaleMacTest, timeAMPMLabels)
     EXPECT_STREQ("\xE5\x8D\x88\xE5\x89\x8D", timeAMPMLabel("ja_JP", 0).utf8().data());
     EXPECT_STREQ("\xE5\x8D\x88\xE5\xBE\x8C", timeAMPMLabel("ja_JP", 1).utf8().data());
 }
+
+TEST_F(LocaleMacTest, decimalSeparator)
+{
+    EXPECT_STREQ(".", decimalSeparator("en_US").utf8().data());
+    EXPECT_STREQ(",", decimalSeparator("fr_FR").utf8().data());
+}
 #endif
+
+static void testNumberIsReversible(const String& localeString, const char* original, const char* shouldHave = 0)
+{
+    OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+    String localized = locale->convertToLocalizedNumber(original);
+    if (shouldHave)
+        EXPECT_TRUE(localized.contains(shouldHave));
+    String converted = locale->convertFromLocalizedNumber(localized);
+    EXPECT_STREQ(original, converted.utf8().data());
+}
+
+void testNumbers(const String& localeString, const char* decimalSeparatorShouldBe = 0)
+{
+    testNumberIsReversible(localeString, "123456789012345678901234567890");
+    testNumberIsReversible(localeString, "-123.456", decimalSeparatorShouldBe);
+    testNumberIsReversible(localeString, ".456", decimalSeparatorShouldBe);
+    testNumberIsReversible(localeString, "-0.456", decimalSeparatorShouldBe);
+}
+
+TEST_F(LocaleMacTest, localizedNumberRoundTrip)
+{
+    // Test some of major locales.
+    testNumbers("en_US", ".");
+    testNumbers("fr_FR", ",");
+    testNumbers("ar");
+    testNumbers("de_DE");
+    testNumbers("es_ES");
+    testNumbers("fa");
+    testNumbers("ja_JP");
+    testNumbers("ko_KR");
+    testNumbers("zh_CN");
+    testNumbers("zh_HK");
+    testNumbers("zh_TW");
+}
diff --git a/Source/WebKit/chromium/tests/LocaleWinTest.cpp b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
index 8da2f4461..5f5642e91 100644
--- a/Source/WebKit/chromium/tests/LocaleWinTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
@@ -57,10 +57,19 @@ protected:
     };
 
     // See http://msdn.microsoft.com/en-us/goglobal/bb964664.aspx
+    // Note that some locales are country-neutral.
     enum {
-        EnglishUS = 0x409,
-        FrenchFR = 0x40C,
-        JapaneseJP = 0x411,
+        ArabicEG = 0x0C01, // ar-eg
+        ChineseCN = 0x0804, // zh-cn
+        ChineseHK = 0x0C04, // zh-hk
+        ChineseTW = 0x0404, // zh-tw
+        German = 0x0407, // de
+        EnglishUS = 0x409, // en-us
+        FrenchFR = 0x40C, // fr
+        JapaneseJP = 0x411, // ja
+        KoreanKR = 0x0412, // ko
+        Persian = 0x0429, // fa
+        Spanish = 0x040A, // es
     };
 
     DateComponents dateComponents(int year, int month, int day)
@@ -131,6 +140,12 @@ protected:
         OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
         return locale->timeAMPMLabels()[index];
     }
+
+    String decimalSeparator(LCID lcid)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->localizedDecimalSeparator();
+    }
 #endif
 };
 
@@ -328,4 +343,52 @@ TEST_F(LocaleWinTest, timeAMPMLabels)
     EXPECT_STREQ("\xE5\x8D\x88\xE5\x89\x8D", timeAMPMLabel(JapaneseJP, 0).utf8().data());
     EXPECT_STREQ("\xE5\x8D\x88\xE5\xBE\x8C", timeAMPMLabel(JapaneseJP, 1).utf8().data());
 }
+
+TEST_F(LocaleWinTest, decimalSeparator)
+{
+    EXPECT_STREQ(".", decimalSeparator(EnglishUS).utf8().data());
+    EXPECT_STREQ(",", decimalSeparator(FrenchFR).utf8().data());
+}
 #endif
+
+static void testNumberIsReversible(LCID lcid, const char* original, const char* shouldHave = 0)
+{
+    OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+    String localized = locale->convertToLocalizedNumber(original);
+    if (shouldHave)
+        EXPECT_TRUE(localized.contains(shouldHave));
+    String converted = locale->convertFromLocalizedNumber(localized);
+    EXPECT_STREQ(original, converted.utf8().data());
+}
+
+void testNumbers(LCID lcid)
+{
+    testNumberIsReversible(lcid, "123456789012345678901234567890");
+    testNumberIsReversible(lcid, "-123.456");
+    testNumberIsReversible(lcid, ".456");
+    testNumberIsReversible(lcid, "-0.456");
+}
+
+TEST_F(LocaleWinTest, localizedNumberRoundTrip)
+{
+    testNumberIsReversible(EnglishUS, "123456789012345678901234567890");
+    testNumberIsReversible(EnglishUS, "-123.456", ".");
+    testNumberIsReversible(EnglishUS, ".456", ".");
+    testNumberIsReversible(EnglishUS, "-0.456", ".");
+
+    testNumberIsReversible(FrenchFR, "123456789012345678901234567890");
+    testNumberIsReversible(FrenchFR, "-123.456", ",");
+    testNumberIsReversible(FrenchFR, ".456", ",");
+    testNumberIsReversible(FrenchFR, "-0.456", ",");
+
+    // Test some of major locales.
+    testNumbers(ArabicEG);
+    testNumbers(German);
+    testNumbers(Spanish);
+    testNumbers(Persian);
+    testNumbers(JapaneseJP);
+    testNumbers(KoreanKR);
+    testNumbers(ChineseCN);
+    testNumbers(ChineseHK);
+    testNumbers(ChineseTW);
+}
diff --git a/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp b/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
new file mode 100644
index 000000000..052936dab
--- /dev/null
+++ b/Source/WebKit/chromium/tests/MemoryInstrumentationTest.cpp
@@ -0,0 +1,228 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "DataRef.h"
+#include "MemoryInstrumentationImpl.h"
+
+#include <gtest/gtest.h>
+
+#include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+using namespace WebCore;
+
+namespace {
+
+class NotInstrumented {
+public:
+    char m_data[42];
+};
+
+class Instrumented {
+public:
+    Instrumented() : m_notInstrumented(new NotInstrumented) { }
+    virtual ~Instrumented() { delete m_notInstrumented; }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addMember(m_notInstrumented);
+    }
+    NotInstrumented* m_notInstrumented;
+};
+
+TEST(MemoryInstrumentationTest, sizeOf)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    Instrumented instrumented;
+    impl.addRootObject(instrumented);
+    EXPECT_EQ(sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(1, visitedObjects.size());
+}
+
+TEST(MemoryInstrumentationTest, nullCheck)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    Instrumented* instrumented = 0;
+    impl.addRootObject(instrumented);
+    EXPECT_EQ(0u, impl.reportedSizeForAllTypes());
+    EXPECT_EQ(0, visitedObjects.size());
+}
+
+TEST(MemoryInstrumentationTest, ptrVsRef)
+{
+    {
+        VisitedObjects visitedObjects;
+        MemoryInstrumentationImpl impl(visitedObjects);
+        Instrumented instrumented;
+        impl.addRootObject(&instrumented);
+        EXPECT_EQ(sizeof(Instrumented) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+        EXPECT_EQ(2, visitedObjects.size());
+    }
+    {
+        VisitedObjects visitedObjects;
+        MemoryInstrumentationImpl impl(visitedObjects);
+        Instrumented instrumented;
+        impl.addRootObject(instrumented);
+        EXPECT_EQ(sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+        EXPECT_EQ(1, visitedObjects.size());
+    }
+}
+
+TEST(MemoryInstrumentationTest, ownPtr)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    OwnPtr<Instrumented> instrumented(adoptPtr(new Instrumented));
+    impl.addRootObject(instrumented);
+    EXPECT_EQ(sizeof(Instrumented) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class InstrumentedRefPtr : public RefCounted<InstrumentedRefPtr> {
+public:
+    InstrumentedRefPtr() : m_notInstrumented(new NotInstrumented) { }
+    virtual ~InstrumentedRefPtr() { delete m_notInstrumented; }
+    static PassRefPtr<InstrumentedRefPtr> create() { return adoptRef(new InstrumentedRefPtr()); }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addMember(m_notInstrumented);
+    }
+    NotInstrumented* m_notInstrumented;
+};
+
+TEST(MemoryInstrumentationTest, dataRef)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    DataRef<InstrumentedRefPtr> instrumentedRefPtr;
+    instrumentedRefPtr.init();
+    impl.addRootObject(instrumentedRefPtr);
+    EXPECT_EQ(sizeof(InstrumentedRefPtr) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+TEST(MemoryInstrumentationTest, refPtr)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    RefPtr<InstrumentedRefPtr> instrumentedRefPtr(adoptRef(new InstrumentedRefPtr));
+    impl.addRootObject(instrumentedRefPtr);
+    EXPECT_EQ(sizeof(InstrumentedRefPtr) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class InstrumentedWithOwnPtr : public Instrumented {
+public:
+    InstrumentedWithOwnPtr() : m_notInstrumentedOwnPtr(adoptPtr(new NotInstrumented)) { }
+
+    virtual void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::CSS);
+        Instrumented::reportMemoryUsage(memoryObjectInfo);
+        info.addMember(m_notInstrumentedOwnPtr);
+    }
+    OwnPtr<NotInstrumented> m_notInstrumentedOwnPtr;
+};
+
+TEST(MemoryInstrumentationTest, ownPtrNotInstrumented)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    InstrumentedWithOwnPtr instrumentedWithOwnPtr;
+    impl.addRootObject(instrumentedWithOwnPtr);
+    EXPECT_EQ(2 * sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class InstrumentedOther {
+public:
+    InstrumentedOther() : m_data(0) { }
+
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::Other);
+    }
+    int m_data;
+};
+
+class InstrumentedDOM {
+public:
+    InstrumentedDOM() : m_instrumentedOther(adoptPtr(new InstrumentedOther)) { }
+
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addInstrumentedMember(m_instrumentedOther);
+    }
+    OwnPtr<InstrumentedOther> m_instrumentedOther;
+};
+
+TEST(MemoryInstrumentationTest, ownerTypePropagation)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    OwnPtr<InstrumentedDOM> instrumentedDOM(adoptPtr(new InstrumentedDOM));
+    impl.addRootObject(instrumentedDOM);
+    EXPECT_EQ(sizeof(InstrumentedDOM) + sizeof(InstrumentedOther), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(sizeof(InstrumentedDOM) + sizeof(InstrumentedOther), impl.totalSize(MemoryInstrumentation::DOM));
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+class NonVirtualInstrumented {
+public:
+    void reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+    {
+        MemoryClassInfo info(memoryObjectInfo, this, MemoryInstrumentation::DOM);
+        info.addInstrumentedMember(m_instrumented);
+    }
+
+    Instrumented m_instrumented;
+};
+
+TEST(MemoryInstrumentationTest, visitFirstMemberInNonVirtualClass)
+{
+    VisitedObjects visitedObjects;
+    MemoryInstrumentationImpl impl(visitedObjects);
+    NonVirtualInstrumented nonVirtualInstrumented;
+    impl.addRootObject(&nonVirtualInstrumented);
+    EXPECT_EQ(sizeof(NonVirtualInstrumented) + sizeof(NotInstrumented), impl.reportedSizeForAllTypes());
+    EXPECT_EQ(2, visitedObjects.size());
+}
+
+} // namespace
+
diff --git a/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp b/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
index 6c6c359a9..927d4a9c3 100644
--- a/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
+++ b/Source/WebKit/chromium/tests/ScrollAnimatorNoneTest.cpp
@@ -64,6 +64,7 @@ public:
     MOCK_METHOD1(setScrollOffsetFromAnimation, void(const IntPoint&));
     MOCK_CONST_METHOD0(enclosingScrollableArea, ScrollableArea*());
 
+    virtual IntPoint scrollPosition() const { return IntPoint(); }
     virtual int visibleHeight() const { return 768; }
     virtual int visibleWidth() const { return 1024; }
 
diff --git a/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
index d2cd9befc..0e3b1fbdb 100644
--- a/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/ScrollbarLayerChromiumTest.cpp
@@ -26,12 +26,17 @@
 
 #include "ScrollbarLayerChromium.h"
 
+#include "FakeWebScrollbarThemeGeometry.h"
 #include "Scrollbar.h"
 #include "Settings.h"
 #include "TreeSynchronizer.h"
+#include "cc/CCScrollbarAnimationController.h"
 #include "cc/CCScrollbarLayerImpl.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <gtest/gtest.h>
+#include <public/WebScrollbar.h>
+#include <public/WebScrollbarThemeGeometry.h>
+#include <public/WebScrollbarThemePainter.h>
 
 using namespace WebCore;
 
@@ -60,7 +65,7 @@ public:
     virtual bool isScrollableAreaActive() const { return false; }
     virtual bool isScrollViewScrollbar() const { return false; }
 
-    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) { return IntPoint(); }
+    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) { return windowPoint; }
 
     virtual bool isCustomScrollbar() const { return false; }
     virtual ScrollbarOrientation orientation() const { return HorizontalScrollbar; }
@@ -83,6 +88,8 @@ public:
     virtual bool enabled() const { return false; }
     virtual void setEnabled(bool) { }
 
+    virtual bool isOverlayScrollbar() const { return false; }
+
     MockScrollbar() : Scrollbar(0, HorizontalScrollbar, RegularScrollbar) { }
     virtual ~MockScrollbar() { }
 };
@@ -91,12 +98,15 @@ TEST(ScrollbarLayerChromiumTest, resolveScrollLayerPointer)
 {
     DebugScopedSetImplThread impl;
 
+    RefPtr<MockScrollbar> mockScrollbar = adoptRef(new MockScrollbar);
+    WebKit::WebScrollbarThemePainter painter(0, mockScrollbar.get());
+
     Settings::setMockScrollbarsEnabled(true);
     {
-        RefPtr<MockScrollbar> scrollbar = adoptRef(new MockScrollbar);
+        OwnPtr<WebKit::WebScrollbar> scrollbar = WebKit::WebScrollbar::create(mockScrollbar.get());
         RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
         RefPtr<LayerChromium> child1 = LayerChromium::create();
-        RefPtr<LayerChromium> child2 = ScrollbarLayerChromium::create(scrollbar.get(), child1->id());
+        RefPtr<LayerChromium> child2 = ScrollbarLayerChromium::create(scrollbar.release(), painter, WebKit::FakeWebScrollbarThemeGeometry::create(), child1->id());
         layerTreeRoot->addChild(child1);
         layerTreeRoot->addChild(child2);
 
@@ -105,14 +115,15 @@ TEST(ScrollbarLayerChromiumTest, resolveScrollLayerPointer)
         CCLayerImpl* ccChild1 = ccLayerTreeRoot->children()[0].get();
         CCScrollbarLayerImpl* ccChild2 = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[1].get());
 
-        EXPECT_EQ(ccChild1, ccChild2->scrollLayer());
+        EXPECT_TRUE(ccChild1->scrollbarAnimationController());
+        EXPECT_EQ(ccChild1->horizontalScrollbarLayer(), ccChild2);
     }
 
     { // another traverse order
-        RefPtr<MockScrollbar> scrollbar = adoptRef(new MockScrollbar);
+        OwnPtr<WebKit::WebScrollbar> scrollbar = WebKit::WebScrollbar::create(mockScrollbar.get());
         RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
         RefPtr<LayerChromium> child2 = LayerChromium::create();
-        RefPtr<LayerChromium> child1 = ScrollbarLayerChromium::create(scrollbar.get(), child2->id());
+        RefPtr<LayerChromium> child1 = ScrollbarLayerChromium::create(scrollbar.release(), painter, WebKit::FakeWebScrollbarThemeGeometry::create(), child2->id());
         layerTreeRoot->addChild(child1);
         layerTreeRoot->addChild(child2);
 
@@ -121,8 +132,56 @@ TEST(ScrollbarLayerChromiumTest, resolveScrollLayerPointer)
         CCScrollbarLayerImpl* ccChild1 = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[0].get());
         CCLayerImpl* ccChild2 = ccLayerTreeRoot->children()[1].get();
 
-        EXPECT_EQ(ccChild1->scrollLayer(), ccChild2);
+        EXPECT_TRUE(ccChild2->scrollbarAnimationController());
+        EXPECT_EQ(ccChild2->horizontalScrollbarLayer(), ccChild1);
     }
 }
 
+TEST(ScrollbarLayerChromiumTest, scrollOffsetSynchronization)
+{
+    DebugScopedSetImplThread impl;
+
+    RefPtr<MockScrollbar> mockScrollbar = adoptRef(new MockScrollbar);
+    WebKit::WebScrollbarThemePainter painter(0, mockScrollbar.get());
+
+    Settings::setMockScrollbarsEnabled(true);
+
+    OwnPtr<WebKit::WebScrollbar> scrollbar = WebKit::WebScrollbar::create(mockScrollbar.get());
+    RefPtr<LayerChromium> layerTreeRoot = LayerChromium::create();
+    RefPtr<LayerChromium> contentLayer = LayerChromium::create();
+    RefPtr<LayerChromium> scrollbarLayer = ScrollbarLayerChromium::create(scrollbar.release(), painter, WebKit::FakeWebScrollbarThemeGeometry::create(), layerTreeRoot->id());
+    layerTreeRoot->addChild(contentLayer);
+    layerTreeRoot->addChild(scrollbarLayer);
+
+    layerTreeRoot->setScrollPosition(IntPoint(10, 20));
+    layerTreeRoot->setMaxScrollPosition(IntSize(30, 50));
+    contentLayer->setBounds(IntSize(100, 200));
+
+    OwnPtr<CCLayerImpl> ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), nullptr, 0);
+
+    CCScrollbarLayerImpl* ccScrollbarLayer = static_cast<CCScrollbarLayerImpl*>(ccLayerTreeRoot->children()[1].get());
+
+    EXPECT_EQ(10, ccScrollbarLayer->currentPos());
+    EXPECT_EQ(100, ccScrollbarLayer->totalSize());
+    EXPECT_EQ(30, ccScrollbarLayer->maximum());
+
+    layerTreeRoot->setScrollPosition(IntPoint(100, 200));
+    layerTreeRoot->setMaxScrollPosition(IntSize(300, 500));
+    contentLayer->setBounds(IntSize(1000, 2000));
+
+    CCScrollbarAnimationController* scrollbarController = ccLayerTreeRoot->scrollbarAnimationController();
+    ccLayerTreeRoot = TreeSynchronizer::synchronizeTrees(layerTreeRoot.get(), ccLayerTreeRoot.release(), 0);
+    EXPECT_EQ(scrollbarController, ccLayerTreeRoot->scrollbarAnimationController());
+
+    EXPECT_EQ(100, ccScrollbarLayer->currentPos());
+    EXPECT_EQ(1000, ccScrollbarLayer->totalSize());
+    EXPECT_EQ(300, ccScrollbarLayer->maximum());
+
+    ccLayerTreeRoot->scrollBy(FloatSize(12, 34));
+
+    EXPECT_EQ(112, ccScrollbarLayer->currentPos());
+    EXPECT_EQ(1000, ccScrollbarLayer->totalSize());
+    EXPECT_EQ(300, ccScrollbarLayer->maximum());
+}
+
 }
diff --git a/Source/WebKit/chromium/tests/TextureCopierTest.cpp b/Source/WebKit/chromium/tests/TextureCopierTest.cpp
index 776e23bfd..432dd7c4a 100644
--- a/Source/WebKit/chromium/tests/TextureCopierTest.cpp
+++ b/Source/WebKit/chromium/tests/TextureCopierTest.cpp
@@ -27,7 +27,6 @@
 #include "TextureCopier.h"
 
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -76,5 +75,6 @@ TEST(TextureCopierTest, testDrawArraysCopy)
     int destTextureId = 2;
     IntSize size(256, 128);
     OwnPtr<AcceleratedTextureCopier> copier(AcceleratedTextureCopier::create(mockContext.get(), false));
-    copier->copyTexture(sourceTextureId, destTextureId, size);
+    TextureCopier::Parameters copy = { sourceTextureId, destTextureId, size };
+    copier->copyTexture(copy);
 }
diff --git a/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp
index d0cc3d96f..54e253995 100644
--- a/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TextureLayerChromiumTest.cpp
@@ -27,10 +27,10 @@
 #include "TextureLayerChromium.h"
 
 #include "FakeCCLayerTreeHostClient.h"
-#include "WebCompositor.h"
 #include "cc/CCLayerTreeHost.h"
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <public/WebCompositor.h>
 
 using namespace WebCore;
 using ::testing::Mock;
diff --git a/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp b/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp
index 39a57d131..3660c9412 100644
--- a/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp
+++ b/Source/WebKit/chromium/tests/ThrottledTextureUploaderTest.cpp
@@ -26,8 +26,8 @@
 
 #include "ThrottledTextureUploader.h"
 
+#include "Extensions3DChromium.h"
 #include "FakeWebGraphicsContext3D.h"
-#include "GraphicsContext3DPrivate.h"
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
diff --git a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
index e39fe7e56..bab7168c4 100644
--- a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
@@ -33,11 +33,12 @@
 #include "FakeCCGraphicsContext.h"
 #include "FakeCCLayerTreeHostClient.h"
 #include "LayerPainterChromium.h"
-#include "WebCompositor.h"
 #include "cc/CCOverdrawMetrics.h"
 #include "cc/CCRenderingStats.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
+#include "cc/CCTextureUpdateController.h"
 #include <gtest/gtest.h>
+#include <public/WebCompositor.h>
 #include <public/WebTransformationMatrix.h>
 
 using namespace WebCore;
@@ -57,7 +58,7 @@ class TestCCOcclusionTracker : public CCOcclusionTracker {
 public:
     TestCCOcclusionTracker()
         : CCOcclusionTracker(IntRect(0, 0, 1000, 1000), true)
-        , m_scissorRectInScreen(IntRect(0, 0, 1000, 1000))
+        , m_layerClipRectInTarget(IntRect(0, 0, 1000, 1000))
     {
         // Pretend we have visited a render surface.
         m_stack.append(StackObject());
@@ -66,10 +67,10 @@ public:
     void setOcclusion(const Region& occlusion) { m_stack.last().occlusionInScreen = occlusion; }
 
 protected:
-    virtual IntRect layerScissorRectInTargetSurface(const LayerChromium* layer) const { return m_scissorRectInScreen; }
+    virtual IntRect layerClipRectInTarget(const LayerChromium* layer) const OVERRIDE { return m_layerClipRectInTarget; }
 
 private:
-    IntRect m_scissorRectInScreen;
+    IntRect m_layerClipRectInTarget;
 };
 
 class TiledLayerChromiumTest : public testing::Test {
@@ -89,12 +90,12 @@ public:
 
     void updateTextures(int count = 500)
     {
-        m_updater.update(m_resourceProvider.get(), &m_copier, &m_uploader, count);
+        CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, &m_queue, count);
     }
 public:
     OwnPtr<CCGraphicsContext> m_context;
     OwnPtr<CCResourceProvider> m_resourceProvider;
-    CCTextureUpdater m_updater;
+    CCTextureUpdateQueue m_queue;
     CCRenderingStats m_stats;
     FakeTextureCopier m_copier;
     FakeTextureUploader m_uploader;
@@ -118,7 +119,7 @@ TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -131,7 +132,7 @@ TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
     // ....but then only update one of them.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should only have the first tile since the other tile was invalidated but not painted.
@@ -149,13 +150,14 @@ TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
+    layer->setDrawableContentRect(IntRect(0, 0, 100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), &occluded, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -171,7 +173,7 @@ TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
     layer->invalidateContentRect(IntRect(0, 0, 50, 50));
     // ....but the area is occluded.
     occluded.setOcclusion(IntRect(0, 0, 50, 50));
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), &occluded, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -199,7 +201,7 @@ TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -221,7 +223,7 @@ TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
     // This should recreate and update the deleted textures.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -250,7 +252,7 @@ TEST_F(TiledLayerChromiumTest, pushIdlePaintTiles)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
     updateTextures();
 
     // We should need idle-painting for 3x3 tiles in the center.
@@ -266,7 +268,7 @@ TEST_F(TiledLayerChromiumTest, pushIdlePaintTiles)
         layer->setTexturePriorities(m_priorityCalculator);
         textureManager->prioritizeTextures();
 
-        layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+        layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
         EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
         updateTextures();
         layer->pushPropertiesTo(layerImpl.get());
@@ -317,8 +319,8 @@ TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     layer2->setTexturePriorities(m_priorityCalculator);
     layer1->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer1->updateContentRect(m_updater, layerRect, 0, m_stats);
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer1->updateContentRect(m_queue, layerRect, 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
 
     // We should need idle-painting for both remaining tiles in layer2.
     EXPECT_TRUE(layer2->needsIdlePaint(layer2Rect));
@@ -335,7 +337,7 @@ TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     layer2->setTexturePriorities(m_priorityCalculator);
     layer1->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
 
     // Oh well, commit the frame and push.
     updateTextures();
@@ -355,8 +357,8 @@ TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     layer2->setTexturePriorities(m_priorityCalculator);
     layer1->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer2->updateContentRect(m_updater, layer2Rect, 0, m_stats);
-    layer1->updateContentRect(m_updater, layerRect, 0, m_stats);
+    layer2->updateContentRect(m_queue, layer2Rect, 0, m_stats);
+    layer1->updateContentRect(m_queue, layerRect, 0, m_stats);
 
     updateTextures();
     layer1->pushPropertiesTo(layerImpl1.get());
@@ -387,7 +389,7 @@ TEST_F(TiledLayerChromiumTest, pushIdlePaintedOccludedTiles)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), &occluded, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -412,7 +414,7 @@ TEST_F(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -442,11 +444,11 @@ TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
     layer2->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
-    layer1->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer1->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
 
     // Invalidate a tile on layer1
     layer2->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer1.get());
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
 
     updateTextures();
     layer1->pushPropertiesTo(layer1Impl.get());
@@ -482,8 +484,8 @@ TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnPreviousLay
 
     // Invalidate a tile on layer2
     layer1->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer2.get());
-    layer1->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
-    layer2->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer1->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures();
     layer1->pushPropertiesTo(layer1Impl.get());
     layer2->pushPropertiesTo(layer2Impl.get());
@@ -517,7 +519,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintOutOfMemory)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
 
     // Idle-painting should see no more priority tiles for painting.
     EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
@@ -530,7 +532,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintOutOfMemory)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
 
     // We shouldn't signal we need another idle paint.
     EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
@@ -559,7 +561,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintZeroSizedLayer)
         textureManager->prioritizeTextures();
 
         // Empty layers don't paint or idle-paint.
-        layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+        layer->updateContentRect(m_queue, contentRect, 0, m_stats);
 
         // Empty layers don't have tiles.
         EXPECT_EQ(0u, layer->numPaintedTiles());
@@ -595,7 +597,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleLayers)
         // Paint / idle-paint.
         layer->setTexturePriorities(m_priorityCalculator);
         textureManager->prioritizeTextures();
-        layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+        layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
 
         // Non-visible layers don't need idle paint.
         EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
@@ -658,7 +660,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
                 layer->setTexturePriorities(m_priorityCalculator);
                 textureManager->prioritizeTextures();
 
-                layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+                layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
                 updateTextures();
                 layer->pushPropertiesTo(layerImpl.get());
             }
@@ -671,7 +673,7 @@ TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
                 layer->setTexturePriorities(m_priorityCalculator);
                 textureManager->prioritizeTextures();
 
-                layer->updateContentRect(m_updater, visibleRect, 0, m_stats);
+                layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
                 updateTextures();
                 layer->pushPropertiesTo(layerImpl.get());
             }
@@ -694,7 +696,7 @@ TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -705,7 +707,7 @@ TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
     // Invoke updateContentRect again. As the layer is valid updateContentRect shouldn't be invoked on
     // the LayerTextureUpdater.
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     EXPECT_EQ(0, layer->fakeLayerTextureUpdater()->prepareCount());
 
@@ -713,12 +715,12 @@ TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
     // setRectToInvalidate triggers invalidateContentRect() being invoked from updateContentRect.
     layer->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(25, 25, 50, 50), layer.get());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
     // The layer should still be invalid as updateContentRect invoked invalidate.
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     updateTextures(1000);
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
 }
@@ -745,7 +747,7 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, contentBounds, 0, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 300, 300 * 0.8), layer->updateRect());
     updateTextures();
 
@@ -753,7 +755,7 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, 0, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(layerBounds), layer->updateRect());
     updateTextures();
 
@@ -762,7 +764,7 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     layer->invalidateContentRect(partialDamage);
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, contentBounds, 0, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(45, 80, 15, 8), layer->updateRect());
 }
 
@@ -784,7 +786,7 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // Push the tiles to the impl side and check that there is exactly one.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 100), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -801,7 +803,7 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // The impl side should get 2x2 tiles now.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 200, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 200, 200), 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -813,7 +815,7 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // impl side.
     layer->setNeedsDisplay();
     layer->setTexturePriorities(m_priorityCalculator);
-    layer->updateContentRect(m_updater, IntRect(1, 0, 0, 1), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(1, 0, 0, 1), 0, m_stats);
     textureManager->prioritizeTextures();
 
     layer->pushPropertiesTo(layerImpl.get());
@@ -852,9 +854,9 @@ TEST_F(TiledLayerChromiumTest, skipsDrawGetsReset)
     childLayer->invalidateContentRect(contentRect);
 
     ccLayerTreeHost->setRootLayer(rootLayer);
-    ccLayerTreeHost->setViewportSize(IntSize(300, 300));
+    ccLayerTreeHost->setViewportSize(IntSize(300, 300), IntSize(300, 300));
 
-    ccLayerTreeHost->updateLayers(m_updater, memoryLimit);
+    ccLayerTreeHost->updateLayers(m_queue, memoryLimit);
 
     // We'll skip the root layer.
     EXPECT_TRUE(rootLayer->skipsDraw());
@@ -865,7 +867,7 @@ TEST_F(TiledLayerChromiumTest, skipsDrawGetsReset)
     // Remove the child layer.
     rootLayer->removeAllChildren();
 
-    ccLayerTreeHost->updateLayers(m_updater, memoryLimit);
+    ccLayerTreeHost->updateLayers(m_queue, memoryLimit);
     EXPECT_FALSE(rootLayer->skipsDraw());
 
     ccLayerTreeHost->contentsTextureManager()->clearAllMemory(m_resourceProvider.get());
@@ -885,7 +887,7 @@ TEST_F(TiledLayerChromiumTest, resizeToSmaller)
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 700, 700), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 700, 700), 0, m_stats);
 
     layer->setBounds(IntSize(200, 200));
     layer->invalidateContentRect(IntRect(0, 0, 200, 200));
@@ -904,7 +906,7 @@ TEST_F(TiledLayerChromiumTest, hugeLayerUpdateCrash)
     // Ensure no crash for bounds where size * size would overflow an int.
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 700, 700), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 700, 700), 0, m_stats);
 }
 
 TEST_F(TiledLayerChromiumTest, partialUpdates)
@@ -930,20 +932,20 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     layer->invalidateContentRect(contentRect);
 
     ccLayerTreeHost->setRootLayer(layer);
-    ccLayerTreeHost->setViewportSize(IntSize(300, 200));
+    ccLayerTreeHost->setViewportSize(IntSize(300, 200), IntSize(300, 200));
 
     // Full update of all 6 tiles.
-    ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+    ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -951,17 +953,17 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
 
     // Full update of 3 tiles and partial update of 3 tiles.
     layer->invalidateContentRect(IntRect(0, 0, 300, 150));
-    ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+    ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         updateTextures(4);
         EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -972,14 +974,14 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
-        ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+        ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
         updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -999,14 +1001,14 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
-        ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+        ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_TRUE(m_updater.hasMoreUpdates());
+        EXPECT_TRUE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -1017,10 +1019,10 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
     {
         DebugScopedSetImplThread implThread;
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
-        ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+        ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
         updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
         layer->pushPropertiesTo(layerImpl.get());
     }
@@ -1042,12 +1044,13 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithoutOcclusion)
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
+    layer->setDrawableContentRect(IntRect(0, 0, 100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 100, 200), 0, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
     EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->prepareRectCount());
 }
 
@@ -1062,12 +1065,13 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     layer->setBounds(IntSize(600, 600));
 
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1075,10 +1079,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     EXPECT_EQ(3, occluded.overdrawMetrics().tilesCulledForUpload());
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+    layer->setTexturePriorities(m_priorityCalculator);
+    textureManager->prioritizeTextures();
 
     occluded.setOcclusion(IntRect(250, 200, 300, 100));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-2, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1086,10 +1092,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     EXPECT_EQ(3 + 2, occluded.overdrawMetrics().tilesCulledForUpload());
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+    layer->setTexturePriorities(m_priorityCalculator);
+    textureManager->prioritizeTextures();
 
     occluded.setOcclusion(IntRect(250, 250, 300, 100));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1109,12 +1117,13 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
     // The partially occluded tiles (by the 150 occlusion height) are visible beyond the occlusion, so not culled.
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 360));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 360));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 360), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 360), &occluded, m_stats);
     EXPECT_EQ(24-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1125,11 +1134,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
     // Now the visible region stops at the edge of the occlusion so the partly visible tiles become fully occluded.
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 350));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 350));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 350), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 350), &occluded, m_stats);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1140,11 +1150,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
     // Now the visible region is even smaller than the occlusion, it should have the same result.
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 340));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 340));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 340), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 340), &occluded, m_stats);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1164,11 +1175,12 @@ TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
     layer->setBounds(IntSize(600, 600));
 
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
+    layer->setDrawableContentRect(IntRect(0, 0, 600, 600));
     layer->setVisibleContentRect(IntRect(0, 0, 600, 600));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
     {
         DebugScopedSetImplThread implThread;
@@ -1180,9 +1192,11 @@ TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
     EXPECT_EQ(3, occluded.overdrawMetrics().tilesCulledForUpload());
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
+    layer->setTexturePriorities(m_priorityCalculator);
+    textureManager->prioritizeTextures();
 
     // Repaint without marking it dirty. The 3 culled tiles will be pre-painted now.
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1207,11 +1221,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
     layer->setDrawTransform(screenTransform);
 
     occluded.setOcclusion(IntRect(100, 100, 150, 50));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1238,11 +1253,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     layer->setScreenSpaceTransform(drawTransform);
 
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     // The content is half the size of the layer (so the number of tiles is fewer).
     // In this case, the content is 300x300, and since the tile size is 100, the
     // number of tiles 3x3.
@@ -1258,11 +1274,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     // a different layer space. In this case the occluded region catches the
     // blown up tiles.
     occluded.setOcclusion(IntRect(200, 200, 300, 200));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1278,11 +1295,12 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     layer->setDrawTransform(screenTransform);
 
     occluded.setOcclusion(IntRect(100, 100, 150, 100));
+    layer->setDrawableContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
-    layer->updateContentRect(m_updater, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1306,6 +1324,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     IntRect visibleBounds = IntRect(0, 0, 100, 150);
 
     layer->setBounds(contentBounds.size());
+    layer->setDrawableContentRect(visibleBounds);
     layer->setVisibleContentRect(visibleBounds);
     layer->setDrawOpacity(1);
 
@@ -1315,7 +1334,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // If the layer doesn't paint opaque content, then the visibleContentOpaqueRegion should be empty.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
 
@@ -1328,7 +1347,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     opaquePaintRect = IntRect(10, 10, 90, 190);
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1341,7 +1360,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
 
     // If we paint again without invalidating, the same stuff should be opaque.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1356,7 +1375,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // not be affected.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(0, 0, 1, 1));
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1371,7 +1390,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // not be affected.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(10, 10, 1, 1));
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(IntRect(10, 100, 90, 100), visibleBounds), opaqueContents.bounds());
@@ -1399,6 +1418,7 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     IntRect visibleBounds = IntRect(0, 0, 100, 300);
 
     layer->setBounds(contentBounds.size());
+    layer->setDrawableContentRect(visibleBounds);
     layer->setVisibleContentRect(visibleBounds);
     layer->setDrawOpacity(1);
 
@@ -1408,7 +1428,7 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     // Invalidates and paints the whole layer.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
@@ -1423,7 +1443,7 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(0, 0, 1, 1));
     layer->invalidateContentRect(IntRect(50, 200, 10, 10));
-    layer->updateContentRect(m_updater, contentBounds, &occluded, m_stats);
+    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
@@ -1458,6 +1478,7 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
 
     root->setBounds(rootRect.size());
     root->setAnchorPoint(FloatPoint());
+    root->setDrawableContentRect(rootRect);
     root->setVisibleContentRect(rootRect);
     root->addChild(surface);
 
@@ -1471,27 +1492,29 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
     child->setAnchorPoint(FloatPoint());
     child->setPosition(childRect.location());
     child->setVisibleContentRect(childRect);
+    child->setDrawableContentRect(rootRect);
 
     child2->setBounds(child2Rect.size());
     child2->setAnchorPoint(FloatPoint());
     child2->setPosition(child2Rect.location());
     child2->setVisibleContentRect(child2Rect);
+    child2->setDrawableContentRect(rootRect);
 
     ccLayerTreeHost->setRootLayer(root);
-    ccLayerTreeHost->setViewportSize(rootRect.size());
+    ccLayerTreeHost->setViewportSize(rootRect.size(), rootRect.size());
 
     // With a huge memory limit, all layers should update and push their textures.
     root->invalidateContentRect(rootRect);
     child->invalidateContentRect(childRect);
     child2->invalidateContentRect(child2Rect);
-    ccLayerTreeHost->updateLayers(m_updater, std::numeric_limits<size_t>::max());
+    ccLayerTreeHost->updateLayers(m_queue, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
         updateTextures(1000);
         EXPECT_EQ(6, root->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(3, child->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(3, child2->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
 
         root->fakeLayerTextureUpdater()->clearUpdateCount();
         child->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -1519,14 +1542,14 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
     root->invalidateContentRect(rootRect);
     child->invalidateContentRect(childRect);
     child2->invalidateContentRect(child2Rect);
-    ccLayerTreeHost->updateLayers(m_updater, (3 * 2 + 3 * 1) * (100 * 100) * 4);
+    ccLayerTreeHost->updateLayers(m_queue, (3 * 2 + 3 * 1) * (100 * 100) * 4);
     {
         DebugScopedSetImplThread implThread;
         updateTextures(1000);
         EXPECT_EQ(6, root->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child2->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
 
         root->fakeLayerTextureUpdater()->clearUpdateCount();
         child->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -1555,14 +1578,14 @@ TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAlloca
     root->invalidateContentRect(rootRect);
     child->invalidateContentRect(childRect);
     child2->invalidateContentRect(child2Rect);
-    ccLayerTreeHost->updateLayers(m_updater, (3 * 1) * (100 * 100) * 4);
+    ccLayerTreeHost->updateLayers(m_queue, (3 * 1) * (100 * 100) * 4);
     {
         DebugScopedSetImplThread implThread;
         updateTextures(1000);
         EXPECT_EQ(0, root->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child->fakeLayerTextureUpdater()->updateCount());
         EXPECT_EQ(0, child2->fakeLayerTextureUpdater()->updateCount());
-        EXPECT_FALSE(m_updater.hasMoreUpdates());
+        EXPECT_FALSE(m_queue.hasMoreUpdates());
 
         root->fakeLayerTextureUpdater()->clearUpdateCount();
         child->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -1646,12 +1669,13 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
     IntRect contentRect(0, 0, 45, 47);
     EXPECT_EQ(contentRect.size(), layer->contentBounds());
     layer->setVisibleContentRect(contentRect);
+    layer->setDrawableContentRect(contentRect);
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
     // Update the whole tile.
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
     layer->trackingLayerPainter()->resetPaintedRect();
 
     EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
@@ -1663,7 +1687,7 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
 
     // Invalidate the entire layer in content space. When painting, the rect given to webkit should match the layer's bounds.
     layer->invalidateContentRect(contentRect);
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
 
     EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
 }
@@ -1681,12 +1705,13 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvali
 
     IntRect contentRect(IntPoint(), layer->contentBounds());
     layer->setVisibleContentRect(contentRect);
+    layer->setDrawableContentRect(contentRect);
 
     layer->setTexturePriorities(m_priorityCalculator);
     textureManager->prioritizeTextures();
 
     // Update the whole tile.
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
     layer->trackingLayerPainter()->resetPaintedRect();
 
     EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
@@ -1698,7 +1723,7 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvali
 
     // Invalidate the entire layer in layer space. When painting, the rect given to webkit should match the layer's bounds.
     layer->setNeedsDisplayRect(layerRect);
-    layer->updateContentRect(m_updater, contentRect, 0, m_stats);
+    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
 
     EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
 }
diff --git a/Source/WebKit/chromium/tests/WebAnimationTest.cpp b/Source/WebKit/chromium/tests/WebAnimationTest.cpp
index df830cae6..c2ccc4503 100644
--- a/Source/WebKit/chromium/tests/WebAnimationTest.cpp
+++ b/Source/WebKit/chromium/tests/WebAnimationTest.cpp
@@ -47,7 +47,7 @@ namespace {
 TEST(WebAnimationTest, MAYBE_DefaultSettings)
 {
     WebFloatAnimationCurve curve;
-    WebAnimation animation(curve, WebAnimation::WebAnimationOpacity);
+    WebAnimation animation(curve, WebAnimation::TargetPropertyOpacity);
 
     // Ensure that the defaults are correct.
     EXPECT_EQ(1, animation.iterations());
@@ -68,7 +68,7 @@ TEST(WebAnimationTest, MAYBE_DefaultSettings)
 TEST(WebAnimationTest, MAYBE_ModifiedSettings)
 {
     WebFloatAnimationCurve curve;
-    WebAnimation animation(curve, WebAnimation::WebAnimationOpacity);
+    WebAnimation animation(curve, WebAnimation::TargetPropertyOpacity);
     animation.setIterations(2);
     animation.setStartTime(2);
     animation.setTimeOffset(2);
diff --git a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
index d5b68a867..902fac981 100644
--- a/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/WebCompositorInputHandlerImplTest.cpp
@@ -27,14 +27,14 @@
 
 #include "WebCompositorInputHandlerImpl.h"
 
-#include "WebCompositor.h"
 #include "WebCompositorInputHandlerClient.h"
 #include "WebInputEvent.h"
 #include "cc/CCActiveGestureAnimation.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCSingleThreadProxy.h"
-#include "platform/WebFloatPoint.h"
-#include "platform/WebPoint.h"
+#include <public/WebCompositor.h>
+#include <public/WebFloatPoint.h>
+#include <public/WebPoint.h>
 
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index 9b745e029..cd23d6268 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -804,4 +804,54 @@ TEST_F(WebFrameTest, GetFullHtmlOfPage)
     EXPECT_TRUE(selectionHtml.isEmpty());
 }
 
+class TestExecuteScriptDuringDidCreateScriptContext : public WebFrameClient {
+public:
+    virtual void didCreateScriptContext(WebFrame* frame, v8::Handle<v8::Context> context, int extensionGroup, int worldId) OVERRIDE
+    {
+        frame->executeScript(WebScriptSource("window.history = 'replaced';"));
+    }
+};
+
+TEST_F(WebFrameTest, ExecuteScriptDuringDidCreateScriptContext)
+{
+    registerMockedHttpURLLoad("hello_world.html");
+
+    TestExecuteScriptDuringDidCreateScriptContext webFrameClient;
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "hello_world.html", true, &webFrameClient);
+
+    webView->mainFrame()->reload();
+    webkit_support::ServeAsynchronousMockedRequests();
+}
+
+class TestDidCreateFrameWebFrameClient : public WebFrameClient {
+public:
+    TestDidCreateFrameWebFrameClient() : m_frameCount(0), m_parent(0)
+    {
+    }
+
+    virtual void didCreateFrame(WebFrame* parent, WebFrame* child) 
+    {
+        m_frameCount++;
+        if (!m_parent)
+            m_parent = parent;
+    }
+    
+    int m_frameCount;
+    WebFrame* m_parent;
+};
+
+TEST_F(WebFrameTest, DidCreateFrame)
+{
+    registerMockedHttpURLLoad("iframes_test.html");
+    registerMockedHttpURLLoad("visible_iframe.html");
+    registerMockedHttpURLLoad("invisible_iframe.html");
+    registerMockedHttpURLLoad("zero_sized_iframe.html");
+
+    TestDidCreateFrameWebFrameClient webFrameClient;
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "iframes_test.html", false, &webFrameClient);
+
+    EXPECT_EQ(webFrameClient.m_frameCount, 3); 
+    EXPECT_EQ(webFrameClient.m_parent, webView->mainFrame());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/WebLayerTest.cpp b/Source/WebKit/chromium/tests/WebLayerTest.cpp
index 12deb5991..5381173ef 100644
--- a/Source/WebKit/chromium/tests/WebLayerTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTest.cpp
@@ -23,19 +23,19 @@
  */
 
 #include "config.h"
-#include "platform/WebLayer.h"
+#include <public/WebLayer.h>
 
 #include "CompositorFakeWebGraphicsContext3D.h"
-#include "WebCompositor.h"
-#include "platform/WebContentLayer.h"
-#include "platform/WebContentLayerClient.h"
-#include "platform/WebExternalTextureLayer.h"
-#include "platform/WebFloatPoint.h"
-#include "platform/WebFloatRect.h"
-#include "platform/WebLayerTreeView.h"
-#include "platform/WebLayerTreeViewClient.h"
-#include "platform/WebRect.h"
-#include "platform/WebSize.h"
+#include <public/WebCompositor.h>
+#include <public/WebContentLayer.h>
+#include <public/WebContentLayerClient.h>
+#include <public/WebExternalTextureLayer.h>
+#include <public/WebFloatPoint.h>
+#include <public/WebFloatRect.h>
+#include <public/WebLayerTreeView.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebRect.h>
+#include <public/WebSize.h>
 
 #include <gmock/gmock.h>
 
@@ -58,6 +58,8 @@ public:
     virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) { }
     virtual WebGraphicsContext3D* createContext3D() { return CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()).leakPtr(); }
     virtual void didRebindGraphicsContext(bool success) { }
+    virtual WebCompositorOutputSurface* createOutputSurface() { return 0; }
+    virtual void didRecreateOutputSurface(bool success) { }
     virtual void willCommit() { }
     virtual void didCommitAndDrawFrame() { }
     virtual void didCompleteSwapBuffers() { }
diff --git a/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp b/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
index 2df259f76..4f0330035 100644
--- a/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
@@ -24,15 +24,16 @@
 
 #include "config.h"
 
-#include "platform/WebLayerTreeView.h"
+#include <public/WebLayerTreeView.h>
 
 #include "CompositorFakeWebGraphicsContext3D.h"
-#include "WebCompositor.h"
-#include "public/WebLayer.h"
-#include "public/WebLayerTreeViewClient.h"
-#include "public/WebThread.h"
+#include "FakeWebCompositorOutputSurface.h"
 #include <gmock/gmock.h>
 #include <public/Platform.h>
+#include <public/WebCompositor.h>
+#include <public/WebLayer.h>
+#include <public/WebLayerTreeViewClient.h>
+#include <public/WebThread.h>
 
 using namespace WebKit;
 using testing::Mock;
@@ -48,8 +49,13 @@ public:
     MOCK_METHOD0(didBeginFrame, void());
     virtual void layout() OVERRIDE { }
     virtual void applyScrollAndScale(const WebSize& scrollDelta, float scaleFactor) OVERRIDE { }
-    virtual WebGraphicsContext3D* createContext3D() OVERRIDE { return CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes()).leakPtr(); }
-    virtual void didRebindGraphicsContext(bool success) OVERRIDE { }
+
+    virtual WebCompositorOutputSurface* createOutputSurface() OVERRIDE
+    {
+        return FakeWebCompositorOutputSurface::create(CompositorFakeWebGraphicsContext3D::create(WebGraphicsContext3D::Attributes())).leakPtr();
+    }
+    virtual void didRecreateOutputSurface(bool) OVERRIDE { }
+
     MOCK_METHOD0(willCommit, void());
     MOCK_METHOD0(didCommit, void());
     virtual void didCommitAndDrawFrame() OVERRIDE { }
diff --git a/Source/WebKit/chromium/tests/data/hello_world.html b/Source/WebKit/chromium/tests/data/hello_world.html
new file mode 100644
index 000000000..75ab18b58
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/hello_world.html
@@ -0,0 +1,3 @@
+<script>
+document.write("Hello, world.");
+</script>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index 8e7f0e2e2..3bc2ceab5 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,92 @@
+2012-08-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Handle SSL errors for SOUP
+        https://bugs.webkit.org/show_bug.cgi?id=90267
+
+        Reviewed by Martin Robinson.
+
+        Ignore SSL errors by default for compatibility.
+
+        * ewk/ewk_main.cpp:
+        (_ewk_init_body):
+
+2012-08-07  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Remove PlatformTouchEventEfl and PlatformTouchPointEfl
+        https://bugs.webkit.org/show_bug.cgi?id=93270
+
+        Reviewed by Eric Seidel.
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_feed_touch_event):
+        * ewk/ewk_touch_event.cpp: Added.
+        (WebKitPlatformTouchPoint):
+        (WebKitPlatformTouchPoint::WebKitPlatformTouchPoint):
+        Added to initialize members of PlatformTouchPoint.
+        (WebKitPlatformTouchEvent):
+        (WebKitPlatformTouchEvent::WebKitPlatformTouchEvent):
+        Added to initialize members of PlatformTouchEvent.
+        (EWKPrivate):
+        (EWKPrivate::platformTouchEvent):
+        Converted Ewk_Touch_Event to PlatformTouchEvent.
+        * ewk/ewk_touch_event_private.h: 
+        (EWKPrivate):
+
+2012-08-07  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        CUSTOM_SCHEME_HANDLER flag should depend on REGISTER_PROTOCOL_HANDLER
+        https://bugs.webkit.org/show_bug.cgi?id=93081
+
+        Reviewed by Adam Barth.
+
+        CUSTOM_SCHEME_HANDLER #if guards are enclosed in the REGISTER_PROTOCOL_HANDLER guards.
+
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp:
+        (WebCore::RegisterProtocolHandlerClientEfl::registerProtocolHandler):
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.h:
+        * ewk/ewk_custom_handler.cpp:
+        (ewk_custom_handler_register_protocol_handler):
+        * ewk/ewk_custom_handler_private.h:
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+
+2012-08-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] [GTK] Register Protocol Handler Client is never deleted
+        https://bugs.webkit.org/show_bug.cgi?id=92745
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added usage of OwnPtr to manage register protocol handler client pointer.
+
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp:
+        (WebCore::RegisterProtocolHandlerClientEfl::create): Factory function returning smart pointer.
+        (WebCore):
+        * WebCoreSupport/RegisterProtocolHandlerClientEfl.h:
+        (RegisterProtocolHandlerClientEfl):
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_priv_new):
+
+2012-08-01  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL][Regression] Build break with NETSCAPE_PLUGIN_API after r123604
+        https://bugs.webkit.org/show_bug.cgi?id=92937
+
+        Unreviewed build fix.
+
+        r123604 replaced strdup to eina_stringshare, but related codes are not
+        changed properly.
+        This patch changes remained code to use eina_stringshare.
+
+        * ewk/ewk_js.cpp:
+        (ewk_js_variant_to_npvariant):
+        (ewk_js_property_free):
+        (ewk_js_npvariant_to_variant):
+        (ewk_js_variant_free):
+        (ewk_js_variant_array_free):
+        * ewk/ewk_js.h:
+
 2012-07-29  YoungTaeck Song  <youngtaeck.song@samsung.com>
 
         [WK2][EFL] TILED_BACKING_STORE support on Efl WebKit2
diff --git a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp
index 8f30850f6..5601241a5 100644
--- a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.cpp
@@ -28,7 +28,7 @@
 #include "config.h"
 #include "RegisterProtocolHandlerClientEfl.h"
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 
 #include "ewk_custom_handler_private.h"
 #include <wtf/text/CString.h>
@@ -53,12 +53,16 @@ static void customHandlerDataDelete(Ewk_Custom_Handler_Data* data)
     delete data;
 }
 
+PassOwnPtr<RegisterProtocolHandlerClientEfl> RegisterProtocolHandlerClientEfl::create(Evas_Object* view)
+{
+    return adoptPtr(new RegisterProtocolHandlerClientEfl(view));
+}
+
 RegisterProtocolHandlerClientEfl::RegisterProtocolHandlerClientEfl(Evas_Object* view)
     : m_view(view)
 {
 }
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 void RegisterProtocolHandlerClientEfl::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title)
 {
     Ewk_Custom_Handler_Data* data = customHandlerDataCreate(m_view, scheme.utf8().data(), baseURL.utf8().data(), url.utf8().data());
@@ -67,7 +71,6 @@ void RegisterProtocolHandlerClientEfl::registerProtocolHandler(const String& sch
     eina_stringshare_del(data->title);
     customHandlerDataDelete(data);
 }
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
 RegisterProtocolHandlerClient::CustomHandlersState RegisterProtocolHandlerClientEfl::isProtocolHandlerRegistered(const String& scheme, const String& baseURL, const String& url)
@@ -89,4 +92,4 @@ void RegisterProtocolHandlerClientEfl::unregisterProtocolHandler(const String& s
 
 }
 
-#endif // ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
diff --git a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h
index f83723f4d..dca3c6cfa 100644
--- a/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/RegisterProtocolHandlerClientEfl.h
@@ -28,18 +28,18 @@
 #ifndef RegisterProtocolHandlerClientEfl_h
 #define RegisterProtocolHandlerClientEfl_h
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 #include "RegisterProtocolHandlerClient.h"
 
+#include <wtf/PassOwnPtr.h>
+
 namespace WebCore {
 class RegisterProtocolHandlerClientEfl : public WebCore::RegisterProtocolHandlerClient {
 public:
-    explicit RegisterProtocolHandlerClientEfl(Evas_Object* view);
-    ~RegisterProtocolHandlerClientEfl() { }
+    static PassOwnPtr<RegisterProtocolHandlerClientEfl> create(Evas_Object* view);
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    ~RegisterProtocolHandlerClientEfl() { }
     virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
     virtual CustomHandlersState isProtocolHandlerRegistered(const String& scheme, const String& baseURL, const String& url);
@@ -48,6 +48,8 @@ public:
 
 private:
     Evas_Object* m_view;
+
+    RegisterProtocolHandlerClientEfl(Evas_Object* view);
 };
 }
 
diff --git a/Source/WebKit/efl/ewk/ewk_custom_handler.cpp b/Source/WebKit/efl/ewk/ewk_custom_handler.cpp
index c76b8dec7..3574a1d8a 100644
--- a/Source/WebKit/efl/ewk/ewk_custom_handler.cpp
+++ b/Source/WebKit/efl/ewk/ewk_custom_handler.cpp
@@ -35,7 +35,6 @@ bool ewk_custom_handler_register_protocol_handler(Ewk_Custom_Handler_Data* data)
     evas_object_smart_callback_call(data->ewkView, "protocolhandler,registration,requested", data);
     return true;
 }
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
 /**
@@ -68,4 +67,6 @@ bool ewk_custom_handler_unregister_protocol_handler(Ewk_Custom_Handler_Data* dat
     evas_object_smart_callback_call(data->ewkView, "protocolhandler,unregistration,requested", data);
     return true;
 }
-#endif
+
+#endif // ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
diff --git a/Source/WebKit/efl/ewk/ewk_custom_handler_private.h b/Source/WebKit/efl/ewk/ewk_custom_handler_private.h
index 907ca6bb1..bc0e21d54 100644
--- a/Source/WebKit/efl/ewk/ewk_custom_handler_private.h
+++ b/Source/WebKit/efl/ewk/ewk_custom_handler_private.h
@@ -24,11 +24,11 @@
 
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
 bool ewk_custom_handler_register_protocol_handler(Ewk_Custom_Handler_Data* data);
-#endif
 
 #if ENABLE(CUSTOM_SCHEME_HANDLER)
 Ewk_Custom_Handlers_State ewk_custom_handler_is_protocol_handler_registered(Ewk_Custom_Handler_Data* data);
 bool ewk_custom_handler_unregister_protocol_handler(Ewk_Custom_Handler_Data* data);
-#endif
 
+#endif // ENABLE(CUSTOM_SCHEME_HANDLER)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
 #endif // ewk_custom_handler_private_h
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index fba460ec0..e8fec6d63 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -57,6 +57,7 @@
 #include "ewk_intent_private.h"
 #include "ewk_private.h"
 #include "ewk_security_origin_private.h"
+#include "ewk_touch_event_private.h"
 #include "ewk_view_private.h"
 #include <Ecore_Input.h>
 #include <Eina.h>
@@ -990,37 +991,7 @@ Eina_Bool ewk_frame_feed_touch_event(Evas_Object* ewkFrame, Ewk_Touch_Event_Type
     Evas_Coord x, y;
     evas_object_geometry_get(smartData->view, &x, &y, 0, 0);
 
-    WebCore::PlatformEvent::Type type;
-    switch (action) {
-    case EWK_TOUCH_START:
-        type = WebCore::PlatformEvent::TouchStart;
-        break;
-    case EWK_TOUCH_MOVE:
-        type = WebCore::PlatformEvent::TouchMove;
-        break;
-    case EWK_TOUCH_END:
-        type = WebCore::PlatformEvent::TouchEnd;
-        break;
-    case EWK_TOUCH_CANCEL:
-        type = WebCore::PlatformEvent::TouchCancel;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    unsigned touchModifiers = 0;
-    if (modifiers & ECORE_EVENT_MODIFIER_ALT)
-        touchModifiers |= WebCore::PlatformEvent::AltKey;
-    if (modifiers & ECORE_EVENT_MODIFIER_CTRL)
-        touchModifiers |= WebCore::PlatformEvent::CtrlKey;
-    if (modifiers & ECORE_EVENT_MODIFIER_SHIFT)
-        touchModifiers |= WebCore::PlatformEvent::ShiftKey;
-    if (modifiers & ECORE_EVENT_MODIFIER_WIN)
-        touchModifiers |= WebCore::PlatformEvent::MetaKey;
-
-    WebCore::PlatformTouchEvent touchEvent(points, WebCore::IntPoint(x, y), type, static_cast<WebCore::PlatformEvent::Modifiers>(touchModifiers));
-    return smartData->frame->eventHandler()->handleTouchEvent(touchEvent);
+    return smartData->frame->eventHandler()->handleTouchEvent(EWKPrivate::platformTouchEvent(x, y, points, action, modifiers));
 #else
     return false;
 #endif
diff --git a/Source/WebKit/efl/ewk/ewk_js.cpp b/Source/WebKit/efl/ewk/ewk_js.cpp
index 0cbb18952..bf4e4d787 100644
--- a/Source/WebKit/efl/ewk/ewk_js.cpp
+++ b/Source/WebKit/efl/ewk/ewk_js.cpp
@@ -48,7 +48,7 @@ static Eina_Bool ewk_js_variant_to_npvariant(const Ewk_JS_Variant* data, NPVaria
 {
     EINA_SAFETY_ON_NULL_RETURN_VAL(data, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(result, false);
-    char* string_value;
+    const char* string_value;
 
     switch (data->type) {
     case EWK_JS_VARIANT_VOID:
@@ -315,7 +315,7 @@ static void ewk_js_property_free(Ewk_JS_Property* prop)
 {
     free(const_cast<char*>(prop->name));
     if (prop->value.type == EWK_JS_VARIANT_STRING)
-        free(prop->value.value.s);
+        eina_stringshare_del(prop->value.value.s);
     else if (prop->value.type == EWK_JS_VARIANT_OBJECT)
         ewk_js_object_free(prop->value.value.o);
     free(prop);
@@ -482,7 +482,6 @@ error:
 
 static Eina_Bool ewk_js_npvariant_to_variant(Ewk_JS_Variant* data, const NPVariant* result)
 {
-    int sz;
     EINA_SAFETY_ON_NULL_RETURN_VAL(data, false);
     EINA_SAFETY_ON_NULL_RETURN_VAL(result, false);
     switch (result->type) {
@@ -503,12 +502,7 @@ static Eina_Bool ewk_js_npvariant_to_variant(Ewk_JS_Variant* data, const NPVaria
         data->value.d = NPVARIANT_TO_DOUBLE(*result);
         break;
     case NPVariantType_String:
-        sz = NPVARIANT_TO_STRING(*result).UTF8Length;
-        data->value.s = static_cast<char*>(malloc(sizeof(char) * (sz + 1)));
-        if (!data->value.s)
-            return false;
-        memcpy(data->value.s, NPVARIANT_TO_STRING(*result).UTF8Characters, sz);
-        data->value.s[sz] = '\0';
+        data->value.s = eina_stringshare_add_length(NPVARIANT_TO_STRING(*result).UTF8Characters, NPVARIANT_TO_STRING(*result).UTF8Length);
         data->type = EWK_JS_VARIANT_STRING;
         break;
     case NPVariantType_Bool:
@@ -715,7 +709,7 @@ void ewk_js_variant_free(Ewk_JS_Variant* jsVariant)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     EINA_SAFETY_ON_NULL_RETURN(jsVariant);
     if (jsVariant->type == EWK_JS_VARIANT_STRING)
-        free(jsVariant->value.s);
+        eina_stringshare_del(jsVariant->value.s);
     else if (jsVariant->type == EWK_JS_VARIANT_OBJECT)
         ewk_js_object_free(jsVariant->value.o);
     free(jsVariant);
@@ -728,7 +722,7 @@ void ewk_js_variant_array_free(Ewk_JS_Variant* jsVariant, int count)
     EINA_SAFETY_ON_NULL_RETURN(jsVariant);
     for (int i = 0; i < count; i++) {
         if (jsVariant[i].type == EWK_JS_VARIANT_STRING)
-            free(jsVariant[i].value.s);
+            eina_stringshare_del(jsVariant[i].value.s);
         else if (jsVariant[i].type == EWK_JS_VARIANT_OBJECT)
             ewk_js_object_free(jsVariant[i].value.o);
     }
diff --git a/Source/WebKit/efl/ewk/ewk_js.h b/Source/WebKit/efl/ewk/ewk_js.h
index 6279357ec..283e6f774 100644
--- a/Source/WebKit/efl/ewk/ewk_js.h
+++ b/Source/WebKit/efl/ewk/ewk_js.h
@@ -68,7 +68,7 @@ struct _Ewk_JS_Variant {
         Eina_Bool b;
         int i;
         double d;
-        char *s;
+        const char *s;
         Ewk_JS_Object *o;
     } value;
 };
diff --git a/Source/WebKit/efl/ewk/ewk_main.cpp b/Source/WebKit/efl/ewk/ewk_main.cpp
index c2ccc6a6d..5850ee8de 100644
--- a/Source/WebKit/efl/ewk/ewk_main.cpp
+++ b/Source/WebKit/efl/ewk/ewk_main.cpp
@@ -176,5 +176,7 @@ Eina_Bool _ewk_init_body(void)
     SoupSessionFeature* auth_dialog = static_cast<SoupSessionFeature*>(g_object_new(EWK_TYPE_SOUP_AUTH_DIALOG, 0));
     soup_session_add_feature(session, auth_dialog);
 
+    WebCore::ResourceHandle::setIgnoreSSLErrors(true);
+
     return true;
 }
diff --git a/Source/WebKit/efl/ewk/ewk_touch_event.cpp b/Source/WebKit/efl/ewk/ewk_touch_event.cpp
new file mode 100644
index 000000000..0695d41ad
--- /dev/null
+++ b/Source/WebKit/efl/ewk/ewk_touch_event.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "PlatformTouchPoint.h"
+#include "ewk_touch_event_private.h"
+#include <Ecore_Input.h>
+#include <wtf/CurrentTime.h>
+
+class WebKitPlatformTouchPoint : public WebCore::PlatformTouchPoint {
+public:
+    WebKitPlatformTouchPoint(unsigned id, const WebCore::IntPoint& windowPos, WebCore::PlatformTouchPoint::State state)
+    {
+        m_id = id;
+        m_state = state;
+        m_screenPos = windowPos;
+        m_pos = windowPos;
+    }
+};
+
+class WebKitPlatformTouchEvent : public WebCore::PlatformTouchEvent {
+public:
+    WebKitPlatformTouchEvent(const Eina_List* points, const WebCore::IntPoint& pos, Ewk_Touch_Event_Type action, unsigned modifiers)
+    {
+        switch (action) {
+        case EWK_TOUCH_START:
+            m_type = WebCore::PlatformEvent::TouchStart;
+            break;
+        case EWK_TOUCH_MOVE:
+            m_type = WebCore::PlatformEvent::TouchMove;
+            break;
+        case EWK_TOUCH_END:
+            m_type = WebCore::PlatformEvent::TouchEnd;
+            break;
+        case EWK_TOUCH_CANCEL:
+            m_type = WebCore::PlatformEvent::TouchCancel;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+
+        if (modifiers & ECORE_EVENT_MODIFIER_ALT)
+            m_modifiers |= WebCore::PlatformEvent::AltKey;
+        if (modifiers & ECORE_EVENT_MODIFIER_CTRL)
+            m_modifiers |= WebCore::PlatformEvent::CtrlKey;
+        if (modifiers & ECORE_EVENT_MODIFIER_SHIFT)
+            m_modifiers |= WebCore::PlatformEvent::ShiftKey;
+        if (modifiers & ECORE_EVENT_MODIFIER_WIN)
+            m_modifiers |= WebCore::PlatformEvent::MetaKey;
+
+        m_timestamp = currentTime();
+
+        const Eina_List* list;
+        void* item;
+        EINA_LIST_FOREACH(points, list, item) {
+            Ewk_Touch_Point* point = static_cast<Ewk_Touch_Point*>(item);
+            WebCore::IntPoint pnt = WebCore::IntPoint(point->x - pos.x(), point->y - pos.y());
+            m_touchPoints.append(WebKitPlatformTouchPoint(point->id, pnt, static_cast<WebCore::PlatformTouchPoint::State>(point->state)));
+        }
+    }
+};
+
+namespace EWKPrivate {
+
+WebCore::PlatformTouchEvent platformTouchEvent(Evas_Coord x, Evas_Coord y, Eina_List* points, Ewk_Touch_Event_Type action, unsigned modifiers)
+{
+    return WebKitPlatformTouchEvent(points, WebCore::IntPoint(x, y), action, modifiers);
+}
+
+}
diff --git a/Source/WebKit/efl/ewk/ewk_touch_event_private.h b/Source/WebKit/efl/ewk/ewk_touch_event_private.h
new file mode 100644
index 000000000..0f7737a88
--- /dev/null
+++ b/Source/WebKit/efl/ewk/ewk_touch_event_private.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_touch_event_private_h
+#define ewk_touch_event_private_h
+
+#include "PlatformTouchEvent.h"
+#include "ewk_frame.h"
+
+namespace EWKPrivate {
+WebCore::PlatformTouchEvent platformTouchEvent(Evas_Coord x, Evas_Coord y, Eina_List* points, Ewk_Touch_Event_Type action, unsigned modifiers);
+} // namespace EWKPrivate
+
+#endif // ewk_touch_event_private_h
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index 5309181b3..081e6ba49 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -103,7 +103,7 @@
 #include "ColorChooserClient.h"
 #endif
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
 #include "RegisterProtocolHandlerClientEfl.h"
 #endif
 
@@ -254,6 +254,9 @@ struct _Ewk_View_Private_Data {
 #if ENABLE(INPUT_TYPE_COLOR)
     WebCore::ColorChooserClient* colorChooserClient;
 #endif
+#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
+    OwnPtr<WebCore::RegisterProtocolHandlerClientEfl> registerProtocolHandlerClient;
+#endif
     struct {
         Ewk_Menu menu;
         WebCore::PopupMenuClient* menuClient;
@@ -761,8 +764,9 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     WebCore::provideBatteryTo(priv->page.get(), new BatteryClientEfl(smartData->self));
 #endif
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER) || ENABLE(CUSTOM_SCHEME_HANDLER)
-    WebCore::provideRegisterProtocolHandlerTo(priv->page.get(), new WebCore::RegisterProtocolHandlerClientEfl(smartData->self));
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    priv->registerProtocolHandlerClient = WebCore::RegisterProtocolHandlerClientEfl::create(smartData->self);
+    WebCore::provideRegisterProtocolHandlerTo(priv->page.get(), priv->registerProtocolHandlerClient.get());
 #endif
 
     priv->pageSettings = priv->page->settings();
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index 27d0d5774..268a9df9d 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,215 @@
+2012-08-10  Alice Cheng  <alice_cheng@apple.com>
+
+        Part 1 of: Extend -webkit-user-select with a new value "all"
+        <rdar://problem/10161404>
+        https://bugs.webkit.org/show_bug.cgi?id=93562
+
+        Reviewed by Dan Bernstein.
+
+        Modify the enum to resolve ambiguous reference
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_class_init): Modify the ambiguous enum
+        (webkit_web_view_select_all): Modify the ambiguous enum
+
+2012-08-10  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Broken implementation of AtkText and AtkEditableText for password fields
+        https://bugs.webkit.org/show_bug.cgi?id=93621
+
+        Reviewed by Chris Fleizach.
+
+        Update unit test to ensure that password input fields behave
+        as expected when inserting and removing characters in them.
+
+        * tests/testatk.c:
+        (testWebkitAtkTextChangedNotifications): Updated unit test to
+        cover the special case of password input fields.
+
+2012-08-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Handle SSL errors for SOUP
+        https://bugs.webkit.org/show_bug.cgi?id=90267
+
+        Reviewed by Martin Robinson.
+
+        Ignore SSL errors by default for compatibility.
+
+        * webkit/webkitglobals.cpp:
+        (webkitInit):
+
+2012-08-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build with GTK2 after r120918.
+
+        * tests/testwebview.c:
+
+2012-08-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Update NEWS and configure.ac for 1.9.6 release
+
+        * NEWS: Added release notes for 1.9.6.
+
+2012-08-06  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [EFL] [GTK] Register Protocol Handler Client is never deleted
+        https://bugs.webkit.org/show_bug.cgi?id=92745
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added usage of OwnPtr to manage register protocol handler client pointer.
+
+        * WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp:
+        (WebKit::RegisterProtocolHandlerClient::create): Factory function returning smart pointer.
+        (WebKit):
+        * WebCoreSupport/RegisterProtocolHandlerClientGtk.h:
+        (RegisterProtocolHandlerClient):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_init):
+        * webkit/webkitwebviewprivate.h:
+
+2012-08-03  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90269
+
+        Reviewed by Martin Robinson.
+
+        Remove enchant specific code from WebKitSpellCheckerEnchant and
+        implement it relying in the new TextCheckerEnchant class in WebCore.
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-08-02  Claudio Saavedra  <csaavedra@igalia.com>
+
+        [GTK] Add WebKitNetworkResponse::suggested-filename property
+        https://bugs.webkit.org/show_bug.cgi?id=92878
+
+        Reviewed by Carlos Garcia Campos.
+
+        Webcore has API the suggested filename for a response, add
+        a property and getter for it in WebKitNetworkResponse.
+
+        * docs/webkitgtk-sections.txt: Add the symbols
+        * webkit/webkitnetworkresponse.cpp:
+        (_WebKitNetworkResponsePrivate): Add suggested_filename.
+        (webkit_network_response_finalize): Free it on finalize
+        (webkit_network_response_get_property): Add the getter call.
+        (webkit_network_response_class_init): Install the property.
+        (webkit_network_response_get_suggested_filename): New getter.
+        * webkit/webkitnetworkresponse.h: Add the declaration to header
+        file.
+
+2012-07-31  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r124207.
+        http://trac.webkit.org/changeset/124207
+        https://bugs.webkit.org/show_bug.cgi?id=92773
+
+        Patch causes crashes on the 64-bit debug builder (and other
+        builders likely) (Requested by zdobersek on #webkit).
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (createEnchantBrokerIfNeeded):
+        (freeSpellCheckingLanguage):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (wordEndIsAContractionApostrophe):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (getAvailableDictionariesCallback):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-07-31  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add a new and reusable enchant-based spellchecker in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90269
+
+        Reviewed by Martin Robinson.
+
+        Remove enchant specific code from WebKitSpellCheckerEnchant and
+        implement it relying in the new TextCheckerEnchant class in WebCore.
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-07-30  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] New lines automatically and repeatedly added to list items in Etherpad
+        https://bugs.webkit.org/show_bug.cgi?id=89971
+
+        Reviewed by Ryosuke Niwa.
+
+        Disable the deletion UI by default. This UI, which was enabled as a side-effect
+        of the addition of the private editing API, seems to expose a bug in Etherpad
+        which causes the continuous insertion of bullet points.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::EditorClient::shouldShowDeleteInterface): Disable the deletion UI by default.
+
+2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r123966 and r123967.
+        http://trac.webkit.org/changeset/123966
+        http://trac.webkit.org/changeset/123967
+        https://bugs.webkit.org/show_bug.cgi?id=92656
+
+        This patch is causing assertion failures on the debug bot
+        (also rolling out a dependent patch) (Requested by mrobinson
+        on #webkit).
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (_WebKitSpellCheckerEnchantPrivate):
+        (createEnchantBrokerIfNeeded):
+        (freeSpellCheckingLanguage):
+        (webkit_spell_checker_enchant_finalize):
+        (webkit_spell_checker_enchant_class_init):
+        (webkit_spell_checker_enchant_init):
+        (wordEndIsAContractionApostrophe):
+        (checkSpellingOfString):
+        (getGuessesForWord):
+        (getAvailableDictionariesCallback):
+        (updateSpellCheckingLanguages):
+        (learnWord):
+        (ignoreWord):
+
+2012-07-30  Claudio Saavedra  <csaavedra@igalia.com>
+
+        [Gtk] Add WK1 API for snapshot retrieval
+        https://bugs.webkit.org/show_bug.cgi?id=92261
+
+        Reviewed by Martin Robinson.
+
+        Add API to WebKitWebView to retrieve a snapshot of its
+        visible contents as a cairo_surface_t.
+
+        * docs/webkitgtk-sections.txt: Add new symbols.
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_snapshot): New
+        method to paint a webview snapshot.
+        * webkit/webkitwebview.h: Ditto.
+
 2012-07-28  Mario Sanchez Prada  <msanchez@igalia.com>
 
         [GTK] Add a new and reusable enchant-based spellchecker in WebCore
diff --git a/Source/WebKit/gtk/NEWS b/Source/WebKit/gtk/NEWS
index 5e7449c64..9f86b12ad 100644
--- a/Source/WebKit/gtk/NEWS
+++ b/Source/WebKit/gtk/NEWS
@@ -1,4 +1,24 @@
 =================
+WebKitGTK+ 1.9.6
+=================
+
+What's new in WebKitGTK+ 1.9.6?
+
+  - Add spell checker API to WebKit2 GTK+ API.
+  - Add WebKitWebView::submit-form signal to WebKit2 GTK+ API.
+  - Add API to get the suggested filename from a
+    WebKitNetworkResponse.
+  - Add webkit_web_view_get_snapshot() to WebKit1 API.
+  - Paste primary selection when middle clicking in X11 WebKit2.
+  - Make sure WebKitWebView always has a main resource and it has
+    already been set when the load has been committed, even for pages
+    loaded from the history cache in WebKit2.
+  - Fix a run time critical warning when gdk_window_get_cursor() is
+    called before WebKitWebView has been realized in WebKit2.
+  - Fix continuous insertion of newlines in Etherpad.
+  - Fix several memory leaks.
+
+=================
 WebKitGTK+ 1.9.5
 =================
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
index ed980d206..5e4b57848 100644
--- a/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
@@ -96,7 +96,7 @@ bool EditorClient::shouldDeleteRange(Range* range)
 
 bool EditorClient::shouldShowDeleteInterface(HTMLElement* element)
 {
-    gboolean accept = TRUE;
+    gboolean accept = FALSE;
     GRefPtr<WebKitDOMHTMLElement> kitElement(adoptGRef(kit(element)));
     g_signal_emit_by_name(m_webView, "should-show-delete-interface-for-element", kitElement.get(), &accept);
     return accept;
diff --git a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp
index 56d1b773e..9e38851e5 100644
--- a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.cpp
@@ -26,6 +26,11 @@
 
 namespace WebKit {
 
+PassOwnPtr<RegisterProtocolHandlerClient> RegisterProtocolHandlerClient::create()
+{
+    return adoptPtr(new RegisterProtocolHandlerClient);
+}
+
 RegisterProtocolHandlerClient::RegisterProtocolHandlerClient()
 {
 }
diff --git a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h
index 938fbc671..f4889f38f 100644
--- a/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/RegisterProtocolHandlerClientGtk.h
@@ -22,14 +22,20 @@
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
 #include "RegisterProtocolHandlerClient.h"
 
+#include <wtf/PassOwnPtr.h>
+
 namespace WebKit {
 
 class RegisterProtocolHandlerClient : public WebCore::RegisterProtocolHandlerClient {
 public:
-    RegisterProtocolHandlerClient();
+    static PassOwnPtr<RegisterProtocolHandlerClient> create();
+
     ~RegisterProtocolHandlerClient() { }
 
     virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+
+private:
+    RegisterProtocolHandlerClient();
 };
 
 }
diff --git a/Source/WebKit/gtk/docs/webkitgtk-sections.txt b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
index 97fbc0507..59970b59c 100644
--- a/Source/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -380,6 +380,7 @@ webkit_network_request_get_type
 WebKitNetworkResponse
 webkit_network_response_get_uri
 webkit_network_response_get_message
+webkit_network_response_get_suggested_filename
 webkit_network_response_set_uri
 <SUBSECTION Standard>
 WEBKIT_NETWORK_RESPONSE
@@ -475,6 +476,7 @@ webkit_web_view_unmark_text_matches
 webkit_web_view_zoom_in
 webkit_web_view_zoom_out
 webkit_web_view_get_window_features
+webkit_web_view_get_snapshot
 <SUBSECTION Standard>
 WEBKIT_WEB_VIEW
 WEBKIT_IS_WEB_VIEW
diff --git a/Source/WebKit/gtk/tests/testatk.c b/Source/WebKit/gtk/tests/testatk.c
index 60c27942b..cc51be804 100644
--- a/Source/WebKit/gtk/tests/testatk.c
+++ b/Source/WebKit/gtk/tests/testatk.c
@@ -55,7 +55,7 @@ static const char* comboBoxSelector = "<html><body><select><option selected valu
 
 static const char* embeddedObjects = "<html><body><p>Choose: <input value='foo' type='checkbox'/>foo <input value='bar' type='checkbox'/>bar (pick one)</p><p>Choose: <select name='foo'><option>bar</option><option>baz</option></select> (pick one)</p><p><input name='foobarbutton' value='foobar' type='button'/></p></body></html>";
 
-static const char* formWithTextInputs = "<html><body><form><input type='text' name='entry' /></form></body></html>";
+static const char* formWithTextInputs = "<html><body><form><input type='text' name='entry' /><input type='password' name='passwordEntry' /></form></body></html>";
 
 static const char* hypertextAndHyperlinks = "<html><body><p>A paragraph with no links at all</p><p><a href='http://foo.bar.baz/'>A line</a> with <a href='http://bar.baz.foo/'>a link in the middle</a> as well as at the beginning and <a href='http://baz.foo.bar/'>at the end</a></p><ol><li>List item with a <span><a href='http://foo.bar.baz/'>link inside a span node</a></span></li></ol></body></html>";
 
@@ -1735,6 +1735,7 @@ static void testWebkitAtkTextChangedNotifications()
     AtkObject* form = atk_object_ref_accessible_child(object, 0);
     g_assert(ATK_IS_OBJECT(form));
 
+    /* First check normal text entries. */
     AtkObject* textEntry = atk_object_ref_accessible_child(form, 0);
     g_assert(ATK_IS_EDITABLE_TEXT(textEntry));
     g_assert(atk_object_get_role(ATK_OBJECT(textEntry)) == ATK_ROLE_ENTRY);
@@ -1766,10 +1767,45 @@ static void testWebkitAtkTextChangedNotifications()
     g_assert_cmpstr(textChangedResult, ==, "|1|4|8|'qux quux'|");
     g_free(text);
 
+    /* Now check for password entries. */
+    AtkObject* passwordEntry = atk_object_ref_accessible_child(form, 1);
+    g_assert(ATK_IS_EDITABLE_TEXT(passwordEntry));
+    g_assert(atk_object_get_role(ATK_OBJECT(passwordEntry)) == ATK_ROLE_PASSWORD_TEXT);
+
+    g_signal_connect(passwordEntry, "text-insert",
+                     G_CALLBACK(textChangedCb),
+                     GINT_TO_POINTER(TEXT_CHANGE_INSERT));
+    g_signal_connect(passwordEntry, "text-remove",
+                     G_CALLBACK(textChangedCb),
+                     GINT_TO_POINTER(TEXT_CHANGE_REMOVE));
+
+    pos = 0;
+    atk_editable_text_insert_text(ATK_EDITABLE_TEXT(passwordEntry), "foobar", 6, &pos);
+    g_assert_cmpstr(textChangedResult, ==, "|1|0|6|'\342\200\242\342\200\242\342\200\242\342\200\242\342\200\242\342\200\242'|");
+    text = atk_text_get_text(ATK_TEXT(passwordEntry), 0, -1);
+    g_assert_cmpstr(text, ==, "\303\242\302\200\302\242\303\242\302\200\302\242");
+    g_free(text);
+
+    atk_editable_text_delete_text(ATK_EDITABLE_TEXT(passwordEntry), 2, 4);
+    g_assert_cmpstr(textChangedResult, ==, "|2|2|2|'\342\200\242\342\200\242'|");
+
+    text = atk_text_get_text(ATK_TEXT(passwordEntry), 0, -1);
+    g_assert_cmpstr(text, ==, "\303\242\302\200\302\242\303\242");
+    g_free(text);
+
+    pos = 3;
+    atk_editable_text_insert_text(ATK_EDITABLE_TEXT(passwordEntry), "qux", 3, &pos);
+    g_assert_cmpstr(textChangedResult, ==, "|1|3|3|'\342\200\242\342\200\242\342\200\242'|");
+
+    text = atk_text_get_text(ATK_TEXT(passwordEntry), 0, -1);
+    g_assert_cmpstr(text, ==, "\303\242\302\200\302\242\303\242\302\200\302\242\303\242");
+    g_free(text);
+
     g_free(textChangedResult);
 
     g_object_unref(form);
     g_object_unref(textEntry);
+    g_object_unref(passwordEntry);
     g_object_unref(webView);
 }
 
diff --git a/Source/WebKit/gtk/tests/testwebview.c b/Source/WebKit/gtk/tests/testwebview.c
index f71aa42b4..80d7eeadc 100644
--- a/Source/WebKit/gtk/tests/testwebview.c
+++ b/Source/WebKit/gtk/tests/testwebview.c
@@ -609,7 +609,9 @@ void doMouseButtonEvent(GtkWidget* widget, GdkEventType eventType, int x, int y,
     event->button.state = modifiers;
     event->button.button = button;
 
+#ifndef GTK_API_VERSION_2
     event->button.device = gdk_device_manager_get_client_pointer(gdk_display_get_device_manager(gtk_widget_get_display(widget)));
+#endif
 
     int xRoot, yRoot;
     gdk_window_get_root_coords(gtk_widget_get_window(widget), x, y, &xRoot, &yRoot);
diff --git a/Source/WebKit/gtk/webkit/webkitglobals.cpp b/Source/WebKit/gtk/webkit/webkitglobals.cpp
index 42f7a1d93..40356b86b 100644
--- a/Source/WebKit/gtk/webkit/webkitglobals.cpp
+++ b/Source/WebKit/gtk/webkit/webkitglobals.cpp
@@ -531,6 +531,8 @@ void webkitInit()
     soup_session_add_feature(session, authDialog);
     g_object_unref(authDialog);
 
+    WebCore::ResourceHandle::setIgnoreSSLErrors(true);
+
 #if USE(CLUTTER)
     gtk_clutter_init(0, 0);
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp b/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp
index d106d1e53..5eb855673 100644
--- a/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp
+++ b/Source/WebKit/gtk/webkit/webkitnetworkresponse.cpp
@@ -24,10 +24,13 @@
 
 #include "ResourceResponse.h"
 #include "webkitglobalsprivate.h"
+#include "webkitnetworkresponseprivate.h"
 #include <glib/gi18n-lib.h>
 #include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
 
+using namespace WebKit;
+
 /**
  * SECTION:webkitnetworkresponse
  * @short_description: the response given to a network request
@@ -43,6 +46,7 @@ G_DEFINE_TYPE(WebKitNetworkResponse, webkit_network_response, G_TYPE_OBJECT);
 
 struct _WebKitNetworkResponsePrivate {
     gchar* uri;
+    gchar* suggestedFilename;
     SoupMessage* message;
 };
 
@@ -53,6 +57,7 @@ enum {
 
     PROP_URI,
     PROP_MESSAGE,
+    PROP_SUGGESTED_FILENAME,
 };
 
 static void webkit_network_response_dispose(GObject* object)
@@ -74,6 +79,7 @@ static void webkit_network_response_finalize(GObject* object)
     WebKitNetworkResponsePrivate* priv = response->priv;
 
     g_free(priv->uri);
+    g_free(priv->suggestedFilename);
 
     G_OBJECT_CLASS(webkit_network_response_parent_class)->finalize(object);
 }
@@ -89,6 +95,9 @@ static void webkit_network_response_get_property(GObject* object, guint property
     case PROP_MESSAGE:
         g_value_set_object(value, webkit_network_response_get_message(response));
         break;
+    case PROP_SUGGESTED_FILENAME:
+        g_value_set_string(value, webkit_network_response_get_suggested_filename(response));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propertyID, pspec);
     }
@@ -150,6 +159,20 @@ static void webkit_network_response_class_init(WebKitNetworkResponseClass* respo
                                                         SOUP_TYPE_MESSAGE,
                                                         (GParamFlags)(WEBKIT_PARAM_READWRITE|G_PARAM_CONSTRUCT_ONLY)));
 
+    /**
+     * WebKitNetworkResponse:suggested-filename:
+     *
+     * The suggested filename for the response.
+     *
+     * Since: 1.10
+     */
+    g_object_class_install_property(objectClass, PROP_SUGGESTED_FILENAME,
+                                    g_param_spec_string("suggested-filename",
+                                                        _("Suggested filename"),
+                                                        _("The suggested filename for the response."),
+                                                        0,
+                                                        WEBKIT_PARAM_READABLE));
+
     g_type_class_add_private(responseClass, sizeof(WebKitNetworkResponsePrivate));
 }
 
@@ -250,6 +273,32 @@ SoupMessage* webkit_network_response_get_message(WebKitNetworkResponse* response
     return priv->message;
 }
 
+/**
+ * webkit_network_response_get_suggested_filename:
+ * @response: a #WebKitNetworkResponse
+ *
+ * Obtains the suggested filename for the given network response. The
+ * suggested filename is taken from the 'Content-Disposition' HTTP
+ * header, but this is not always present, and this method will return
+ * %NULL in such case.
+ *
+ * Returns: (transfer none): the suggested filename or %NULL if not present
+ * Since: 1.10
+ **/
+const gchar* webkit_network_response_get_suggested_filename(WebKitNetworkResponse* response)
+{
+    g_return_val_if_fail(WEBKIT_IS_NETWORK_RESPONSE(response), 0);
+
+    WebKitNetworkResponsePrivate* priv = response->priv;
+
+    if (priv->suggestedFilename)
+        return priv->suggestedFilename;
+
+    WebCore::ResourceResponse coreResponse = core(response);
+    priv->suggestedFilename = g_strdup(coreResponse.suggestedFilename().utf8().data());
+    return priv->suggestedFilename;
+}
+
 namespace WebKit {
 
 WebCore::ResourceResponse core(WebKitNetworkResponse* response)
diff --git a/Source/WebKit/gtk/webkit/webkitnetworkresponse.h b/Source/WebKit/gtk/webkit/webkitnetworkresponse.h
index 8009aef0a..359b3322a 100644
--- a/Source/WebKit/gtk/webkit/webkitnetworkresponse.h
+++ b/Source/WebKit/gtk/webkit/webkitnetworkresponse.h
@@ -69,6 +69,9 @@ webkit_network_response_get_uri  (WebKitNetworkResponse *response);
 WEBKIT_API SoupMessage *
 webkit_network_response_get_message(WebKitNetworkResponse* response);
 
+WEBKIT_API const char *
+webkit_network_response_get_suggested_filename(WebKitNetworkResponse *response);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
index 0a226928b..07d34d156 100644
--- a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
+++ b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
@@ -74,14 +74,14 @@ static void webkit_spell_checker_enchant_init(WebKitSpellCheckerEnchant* checker
 static void checkSpellingOfString(WebKitSpellChecker* checker, const char* string, int* misspellingLocation, int* misspellingLength)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->checkSpellingOfString(String(string), *misspellingLocation, *misspellingLength);
+    priv->textCheckerEnchant->checkSpellingOfString(String::fromUTF8(string), *misspellingLocation, *misspellingLength);
 }
 
 static char** getGuessesForWord(WebKitSpellChecker* checker, const char* word, const char* context)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
 
-    Vector<String> guesses = priv->textCheckerEnchant->getGuessesForWord(String(word));
+    Vector<String> guesses = priv->textCheckerEnchant->getGuessesForWord(String::fromUTF8(word));
 
     if (guesses.isEmpty())
         return 0;
@@ -99,7 +99,7 @@ static char** getGuessesForWord(WebKitSpellChecker* checker, const char* word, c
 static void updateSpellCheckingLanguages(WebKitSpellChecker* checker, const char* languages)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->updateSpellCheckingLanguages(String(languages));
+    priv->textCheckerEnchant->updateSpellCheckingLanguages(String::fromUTF8(languages));
 }
 
 static char* getAutocorrectSuggestionsForMisspelledWord(WebKitSpellChecker* checker, const char* word)
@@ -110,13 +110,13 @@ static char* getAutocorrectSuggestionsForMisspelledWord(WebKitSpellChecker* chec
 static void learnWord(WebKitSpellChecker* checker, const char* word)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->learnWord(String(word));
+    priv->textCheckerEnchant->learnWord(String::fromUTF8(word));
 }
 
 static void ignoreWord(WebKitSpellChecker* checker, const char* word)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->ignoreWord(String(word));
+    priv->textCheckerEnchant->ignoreWord(String::fromUTF8(word));
 }
 
 static void webkit_spell_checker_enchant_spell_checker_interface_init(WebKitSpellCheckerInterface* interface)
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index 810eec9c6..0b8d6a8f0 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -118,10 +118,6 @@
 #include "DeviceOrientationClientGtk.h"
 #endif
 
-#if ENABLE(REGISTER_PROTOCOL_HANDLER)
-#include "RegisterProtocolHandlerClientGtk.h"
-#endif
-
 /**
  * SECTION:webkitwebview
  * @short_description: The central class of the WebKitGTK+ API
@@ -2294,7 +2290,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
      *
      * The default bindings for this signal is Ctrl-a.
      */
-    webkit_web_view_signals[SELECT_ALL] = g_signal_new("select-all",
+    webkit_web_view_signals[::SELECT_ALL] = g_signal_new("select-all",
             G_TYPE_FROM_CLASS(webViewClass),
             (GSignalFlags)(G_SIGNAL_RUN_LAST | G_SIGNAL_ACTION),
             G_STRUCT_OFFSET(WebKitWebViewClass, select_all),
@@ -3635,7 +3631,8 @@ static void webkit_web_view_init(WebKitWebView* webView)
 #endif
 
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
-    WebCore::provideRegisterProtocolHandlerTo(priv->corePage, new WebKit::RegisterProtocolHandlerClient);
+    priv->registerProtocolHandlerClient = WebKit::RegisterProtocolHandlerClient::create();
+    WebCore::provideRegisterProtocolHandlerTo(priv->corePage, priv->registerProtocolHandlerClient.get());
 #endif
 
     if (DumpRenderTreeSupportGtk::dumpRenderTreeModeEnabled()) {
@@ -4422,7 +4419,7 @@ void webkit_web_view_select_all(WebKitWebView* webView)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
 
-    g_signal_emit(webView, webkit_web_view_signals[SELECT_ALL], 0);
+    g_signal_emit(webView, webkit_web_view_signals[::SELECT_ALL], 0);
 }
 
 /**
@@ -5259,6 +5256,44 @@ GtkMenu* webkit_web_view_get_context_menu(WebKitWebView* webView)
 #endif
 }
 
+/**
+ * webkit_web_view_get_snapshot:
+ * @web_view: a #WebKitWebView
+ *
+ * Retrieves a snapshot with the visible contents of @webview.
+ *
+ * Returns: (transfer full): a @cairo_surface_t
+ *
+ * Since: 1.10
+ **/
+cairo_surface_t*
+webkit_web_view_get_snapshot(WebKitWebView* webView)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
+
+    Frame* frame = core(webView)->mainFrame();
+    if (!frame || !frame->contentRenderer() || !frame->view())
+        return 0;
+
+    frame->view()->updateLayoutAndStyleIfNeededRecursive();
+    GtkAllocation allocation;
+    gtk_widget_get_allocation(GTK_WIDGET(webView), &allocation);
+    cairo_surface_t* surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, allocation.width, allocation.height);
+    RefPtr<cairo_t> cr = adoptRef(cairo_create(surface));
+    GraphicsContext gc(cr.get());
+
+    IntRect rect = allocation;
+    gc.applyDeviceScaleFactor(frame->page()->deviceScaleFactor());
+    gc.save();
+    gc.clip(rect);
+    if (webView->priv->transparent)
+        gc.clearRect(rect);
+    frame->view()->paint(&gc, rect);
+    gc.restore();
+
+    return surface;
+}
+
 void webViewEnterFullscreen(WebKitWebView* webView, Node* node)
 {
     if (!node->hasTagName(HTMLNames::videoTag))
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.h b/Source/WebKit/gtk/webkit/webkitwebview.h
index 87c197acf..9c84263b4 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.h
+++ b/Source/WebKit/gtk/webkit/webkitwebview.h
@@ -446,6 +446,9 @@ webkit_web_view_get_dom_document                (WebKitWebView        *web_view)
 WEBKIT_API WebKitViewportAttributes*
 webkit_web_view_get_viewport_attributes         (WebKitWebView        *web_view);
 
+WEBKIT_API cairo_surface_t*
+webkit_web_view_get_snapshot                    (WebKitWebView        *web_view);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
index 72a8dbc05..c302696d2 100644
--- a/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
+++ b/Source/WebKit/gtk/webkit/webkitwebviewprivate.h
@@ -39,6 +39,10 @@
 #include "UserMediaClientGtk.h"
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+#include "RegisterProtocolHandlerClientGtk.h"
+#endif
+
 namespace WebKit {
 WebCore::Page* core(WebKitWebView*);
 WebKitWebView* kit(WebCore::Page*);
@@ -117,6 +121,10 @@ struct _WebKitWebViewPrivate {
 #if ENABLE(GEOLOCATION)
     OwnPtr<WebCore::GeolocationClientMock> geolocationClientMock;
 #endif
+
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    OwnPtr<WebKit::RegisterProtocolHandlerClient> registerProtocolHandlerClient;
+#endif
 };
 
 void webkit_web_view_notify_ready(WebKitWebView*);
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 05df0aed5..9317bd2f7 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,67 @@
+2012-08-09  Kinuko Yasuda  <kinuko@chromium.org>
+
+        http/tests/security/mixedContent/blob-url-in-iframe.html fails on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=88736
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebView::_canHandleRequest should return true for "blob:" URL so that it can be shown in iframe.
+
+        * WebView/WebView.mm:
+        (+[WebView _canHandleRequest:forMainFrame:]):
+
+2012-08-08  Shane Stephens  <shanestephens@google.com>
+
+        Compile flag for CSS Hierarchies
+        https://bugs.webkit.org/show_bug.cgi?id=92433
+
+        Reviewed by Tony Chang.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-08-05  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] implement setting breakpoints by line:column
+        https://bugs.webkit.org/show_bug.cgi?id=53003
+
+        Unreviewed, just changed the interface according the changes of base class JSC::Debugger.
+
+        No JSC can provide the column info of current JS statement, mac porting can use it to support
+        "Pretty Print" debug mode.
+
+        * WebView/WebScriptDebugger.h:
+        (WebScriptDebugger):
+        * WebView/WebScriptDebugger.mm:
+        (WebScriptDebugger::callEvent):
+        (WebScriptDebugger::atStatement):
+        (WebScriptDebugger::returnEvent):
+        (WebScriptDebugger::exception):
+        (WebScriptDebugger::willExecuteProgram):
+        (WebScriptDebugger::didExecuteProgram):
+        (WebScriptDebugger::didReachBreakpoint):
+
+2012-08-01  Jian Li  <jianli@chromium.org>
+
+        Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port
+        https://bugs.webkit.org/show_bug.cgi?id=90298
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define.
+
+2012-08-01  Antti Koivisto  <antti@apple.com>
+
+        Assertion failure in inspector/profiler/heap-snapshot-containment-show-all.html on Lion bot
+        https://bugs.webkit.org/show_bug.cgi?id=92888
+
+        Reviewed by Andreas Kling.
+
+        Protect the WebInspectorWindowController so it doesn't get destroyed during [WebView close] and cause
+        unsafe [WebView dealloc].
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController destroyInspectorView:]):
+
 2012-07-29  Rik Cabanier  <cabanier@adobe.com>
 
         Add ENABLE_CSS_COMPOSITING flag
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 70cf60c23..10257077c 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -40,6 +40,7 @@ ENABLE_CSP_NEXT = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_EXCLUSIONS = ENABLE_CSS_EXCLUSIONS;
 ENABLE_CSS_FILTERS = ENABLE_CSS_FILTERS;
+ENABLE_CSS_HIERARCHIES = ;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
@@ -134,7 +135,9 @@ ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
 ENABLE_WEB_TIMING = ;
+ENABLE_WIDGET_REGION = $(ENABLE_WIDGET_REGION_$(REAL_PLATFORM_NAME));
+ENABLE_WIDGET_REGION_macosx = ENABLE_WIDGET_REGION;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/Configurations/Version.xcconfig b/Source/WebKit/mac/Configurations/Version.xcconfig
index b827ad3ef..c88c7e97b 100644
--- a/Source/WebKit/mac/Configurations/Version.xcconfig
+++ b/Source/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 537;
-MINOR_VERSION = 3;
+MINOR_VERSION = 6;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index fda659256..97d331c34 100644
--- a/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/Source/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -511,6 +511,7 @@ void WebInspectorFrontendClient::updateWindowTitle() const
             inspectedPage->inspectorController()->disconnectFrontend();
     }
 
+    RetainPtr<WebInspectorWindowController> protect(self);
     [_webView close];
 }
 
diff --git a/Source/WebKit/mac/WebView/WebScriptDebugger.h b/Source/WebKit/mac/WebView/WebScriptDebugger.h
index 784a80294..b551f7dc8 100644
--- a/Source/WebKit/mac/WebView/WebScriptDebugger.h
+++ b/Source/WebKit/mac/WebView/WebScriptDebugger.h
@@ -54,13 +54,13 @@ public:
     void initGlobalCallFrame(const JSC::DebuggerCallFrame&);
 
     virtual void sourceParsed(JSC::ExecState*, JSC::SourceProvider*, int errorLine, const JSC::UString& errorMsg);
-    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, bool hasHandler);
-    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
+    virtual void callEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void atStatement(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void returnEvent(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber);
+    virtual void exception(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber, int columnNumber, bool hasHandler);
+    virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnno);
+    virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnno);
+    virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno, int columnno);
 
     JSC::JSGlobalObject* globalObject() const { return m_globalObject.get(); }
     WebScriptCallFrame *globalCallFrame() const { return m_globalCallFrame.get(); }
diff --git a/Source/WebKit/mac/WebView/WebScriptDebugger.mm b/Source/WebKit/mac/WebView/WebScriptDebugger.mm
index 65f41c89a..4ffe725b8 100644
--- a/Source/WebKit/mac/WebView/WebScriptDebugger.mm
+++ b/Source/WebKit/mac/WebView/WebScriptDebugger.mm
@@ -142,7 +142,7 @@ void WebScriptDebugger::sourceParsed(ExecState* exec, SourceProvider* sourceProv
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void WebScriptDebugger::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_callingDelegate)
         return;
@@ -161,7 +161,7 @@ void WebScriptDebugger::callEvent(const DebuggerCallFrame& debuggerCallFrame, in
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void WebScriptDebugger::atStatement(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_callingDelegate)
         return;
@@ -180,7 +180,7 @@ void WebScriptDebugger::atStatement(const DebuggerCallFrame& debuggerCallFrame,
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
+void WebScriptDebugger::returnEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber)
 {
     if (m_callingDelegate)
         return;
@@ -202,7 +202,7 @@ void WebScriptDebugger::returnEvent(const DebuggerCallFrame& debuggerCallFrame,
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, bool hasHandler)
+void WebScriptDebugger::exception(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber, int columnNumber, bool hasHandler)
 {
     if (m_callingDelegate)
         return;
@@ -224,17 +224,17 @@ void WebScriptDebugger::exception(const DebuggerCallFrame& debuggerCallFrame, in
     m_callingDelegate = false;
 }
 
-void WebScriptDebugger::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno)
+void WebScriptDebugger::willExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno, int columnno)
 {
-    callEvent(debuggerCallFrame, sourceID, lineno);
+    callEvent(debuggerCallFrame, sourceID, lineno, columnno);
 }
 
-void WebScriptDebugger::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno)
+void WebScriptDebugger::didExecuteProgram(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineno, int columnno)
 {
-    returnEvent(debuggerCallFrame, sourceID, lineno);
+    returnEvent(debuggerCallFrame, sourceID, lineno, columnno);
 }
 
-void WebScriptDebugger::didReachBreakpoint(const DebuggerCallFrame&, intptr_t, int)
+void WebScriptDebugger::didReachBreakpoint(const DebuggerCallFrame&, intptr_t, int, int)
 {
     return;
 }
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index a62f27ecb..3391ab967 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -1760,8 +1760,16 @@ static inline IMP getMethod(id o, SEL s)
     // Representations for URL schemes work at the top level.
     if (forMainFrame && [self _representationExistsForURLScheme:scheme])
         return YES;
-        
-    return [scheme _webkit_isCaseInsensitiveEqualToString:@"applewebdata"];
+
+    if ([scheme _webkit_isCaseInsensitiveEqualToString:@"applewebdata"])
+        return YES;
+
+#if ENABLE(BLOB)
+    if ([scheme _webkit_isCaseInsensitiveEqualToString:@"blob"])
+        return YES;
+#endif
+
+    return NO;
 }
 
 + (BOOL)_canHandleRequest:(NSURLRequest *)request
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.cpp b/Source/WebKit/qt/Api/qgraphicswebview.cpp
index 343c2a166..3e8abbad9 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/Source/WebKit/qt/Api/qgraphicswebview.cpp
@@ -309,9 +309,7 @@ bool QGraphicsWebView::sceneEvent(QEvent* event)
     if (d->page && (event->type() == QEvent::TouchBegin
                 || event->type() == QEvent::TouchEnd
                 || event->type() == QEvent::TouchUpdate
-#if HAVE(QT5)
                 || event->type() == QEvent::TouchCancel
-#endif
        )) {
         d->page->event(event);
 
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.h b/Source/WebKit/qt/Api/qgraphicswebview.h
index 15fe087d6..0f9f17b48 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.h
+++ b/Source/WebKit/qt/Api/qgraphicswebview.h
@@ -23,11 +23,7 @@
 #include "qwebkitglobal.h"
 #include "qwebpage.h"
 #include <QtCore/qurl.h>
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include <QtWidgets/qgraphicswidget.h>
-#else
-#include <QtGui/qgraphicswidget.h>
-#endif
 #include <QtGui/qevent.h>
 #include <QtGui/qicon.h>
 #include <QtGui/qpainter.h>
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index dac4165e9..52b97382d 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -97,10 +97,6 @@
 #include <qregion.h>
 #include <qnetworkrequest.h>
 
-#if ENABLE(ORIENTATION_EVENTS) && !HAVE(QT5)
-QTM_USE_NAMESPACE
-#endif
-
 using namespace WebCore;
 
 // from text/qfont.cpp
@@ -492,45 +488,9 @@ void QWebFramePrivate::_q_orientationChanged()
 
 void QWebFramePrivate::didClearWindowObject()
 {
-    if (page->settings()->testAttribute(QWebSettings::JavascriptEnabled))
-        addQtSenderToGlobalObject();
     emit q->javaScriptWindowObjectCleared();
 }
 
-static JSValueRef qtSenderCallback(JSContextRef context, JSObjectRef, JSObjectRef, size_t, const JSValueRef[], JSValueRef*)
-{
-    QObject* sender = JSC::Bindings::QtInstance::qtSenderStack()->top();
-    if (!sender)
-        return JSValueMakeUndefined(context);
-
-    JSC::ExecState* exec = ::toJS(context);
-    RefPtr<JSC::Bindings::RootObject> rootObject = JSC::Bindings::findRootObject(exec->dynamicGlobalObject());
-    JSC::JSObject* jsSender = JSC::Bindings::QtInstance::getQtInstance(sender, rootObject, JSC::Bindings::QtInstance::QtOwnership)->createRuntimeObject(exec);
-    return ::toRef(jsSender);
-}
-
-void QWebFramePrivate::addQtSenderToGlobalObject()
-{
-    JSDOMWindow* window = toJSDOMWindow(frame, mainThreadNormalWorld());
-    Q_ASSERT(window);
-
-    JSC::ExecState* exec = window->globalExec();
-    Q_ASSERT(exec);
-    JSC::JSLockHolder lock(exec);
-
-    JSContextRef context = ::toRef(exec);
-    JSRetainPtr<JSStringRef> propertyName(Adopt, JSStringCreateWithUTF8CString("__qt_sender__"));
-    JSObjectRef function = JSObjectMakeFunctionWithCallback(context, propertyName.get(), qtSenderCallback);
-
-    // JSC public API doesn't support setting a Getter for a property of a given object, https://bugs.webkit.org/show_bug.cgi?id=61374.
-    JSC::PropertyDescriptor descriptor;
-    descriptor.setGetter(::toJS(function));
-    descriptor.setSetter(JSC::jsUndefined());
-    descriptor.setEnumerable(false);
-    descriptor.setConfigurable(false);
-    window->methodTable()->defineOwnProperty(window, exec, propertyName.get()->identifier(&exec->globalData()), descriptor, false);
-}
-
 /*!
     \class QWebFrame
     \since 4.4
@@ -650,11 +610,7 @@ QWebFrame::~QWebFrame()
 
     The ownership of \a object is specified using \a own.
 */
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object, ValueOwnership ownership)
-#else
-void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object, QScriptEngine::ValueOwnership ownership)
-#endif
 {
     if (!page()->settings()->testAttribute(QWebSettings::JavascriptEnabled))
         return;
diff --git a/Source/WebKit/qt/Api/qwebframe.h b/Source/WebKit/qt/Api/qwebframe.h
index 6d486d50e..ca96661e3 100644
--- a/Source/WebKit/qt/Api/qwebframe.h
+++ b/Source/WebKit/qt/Api/qwebframe.h
@@ -28,10 +28,6 @@
 #include <QtNetwork/qnetworkaccessmanager.h>
 #include "qwebkitglobal.h"
 
-#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
-#include <QtScript/qscriptengine.h>
-#endif
-
 QT_BEGIN_NAMESPACE
 class QRect;
 class QPoint;
@@ -124,13 +120,11 @@ private:
     ~QWebFrame();
 
 public:
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
     enum ValueOwnership {
         QtOwnership,
         ScriptOwnership,
         AutoOwnership
     };
-#endif
 
     QWebPage *page() const;
 
@@ -139,11 +133,7 @@ public:
     void setHtml(const QString &html, const QUrl &baseUrl = QUrl());
     void setContent(const QByteArray &data, const QString &mimeType = QString(), const QUrl &baseUrl = QUrl());
 
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
     void addToJavaScriptWindowObject(const QString &name, QObject *object, ValueOwnership ownership = QtOwnership);
-#else
-    void addToJavaScriptWindowObject(const QString &name, QObject *object, QScriptEngine::ValueOwnership ownership = QScriptEngine::QtOwnership);
-#endif
     QString toHtml() const;
     QString toPlainText() const;
     QString renderTreeDump() const;
diff --git a/Source/WebKit/qt/Api/qwebframe_p.h b/Source/WebKit/qt/Api/qwebframe_p.h
index 2762c2be7..3201aaa57 100644
--- a/Source/WebKit/qt/Api/qwebframe_p.h
+++ b/Source/WebKit/qt/Api/qwebframe_p.h
@@ -30,9 +30,6 @@
 #include "PlatformString.h"
 #if ENABLE(ORIENTATION_EVENTS)
 #include "qorientationsensor.h"
-#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
-using QTM_NAMESPACE::QOrientationSensor;
-#endif
 #endif // ENABLE(ORIENTATION_EVENTS).
 #include "qwebelement.h"
 #include "wtf/RefPtr.h"
@@ -132,11 +129,6 @@ public:
 #if ENABLE(ORIENTATION_EVENTS)
     QOrientationSensor m_orientation;
 #endif // ENABLE(ORIENTATION_EVENTS).
-
-private:
-#if USE(JSC)
-    void addQtSenderToGlobalObject();
-#endif
 };
 
 class QWebHitTestResultPrivate {
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index 8e9633d18..08e86183a 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -113,7 +113,6 @@
 #include "SystemInfo.h"
 #endif // Q_OS_WIN32
 #include "TextIterator.h"
-#include "UtilsQt.h"
 #include "WebEventConversion.h"
 #include "WindowFeatures.h"
 #include "WorkerThread.h"
@@ -3162,9 +3161,7 @@ bool QWebPage::event(QEvent *ev)
     case QEvent::TouchBegin:
     case QEvent::TouchUpdate:
     case QEvent::TouchEnd:
-#if HAVE(QT5)
     case QEvent::TouchCancel:
-#endif
         // Return whether the default action was cancelled in the JS event handler
         return d->touchEvent(static_cast<QTouchEvent*>(ev));
 #ifndef QT_NO_PROPERTIES
diff --git a/Source/WebKit/qt/Api/qwebpage.h b/Source/WebKit/qt/Api/qwebpage.h
index 0bf35e247..66f89609b 100644
--- a/Source/WebKit/qt/Api/qwebpage.h
+++ b/Source/WebKit/qt/Api/qwebpage.h
@@ -26,11 +26,7 @@
 
 #include <QtCore/qobject.h>
 #include <QtCore/qurl.h>
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include <QtWidgets/qwidget.h>
-#else
-#include <QtGui/qwidget.h>
-#endif
 
 QT_BEGIN_NAMESPACE
 class QNetworkProxy;
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index 588dcf7aa..774da5d31 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -46,11 +46,7 @@
 #include "FileSystem.h"
 
 #include <QApplication>
-#if HAVE(QT5)
 #include <QStandardPaths>
-#else
-#include <QDesktopServices>
-#endif
 #include <QDir>
 #include <QHash>
 #include <QSharedData>
@@ -1145,11 +1141,7 @@ void QWebSettings::enablePersistentStorage(const QString& path)
 
     if (path.isEmpty()) {
 
-#if HAVE(QT5)
         storagePath = QStandardPaths::writableLocation(QStandardPaths::DataLocation);
-#else
-        storagePath = QDesktopServices::storageLocation(QDesktopServices::DataLocation);
-#endif
         if (storagePath.isEmpty())
             storagePath = WebCore::pathByAppendingComponent(QDir::homePath(), QCoreApplication::applicationName());
     } else
@@ -1168,11 +1160,7 @@ void QWebSettings::enablePersistentStorage(const QString& path)
 #if ENABLE(NETSCAPE_PLUGIN_METADATA_CACHE)
     // All applications can share the common QtWebkit cache file(s).
     // Path is not configurable and uses QDesktopServices::CacheLocation by default.
-#if HAVE(QT5)
     QString cachePath = QStandardPaths::writableLocation(QStandardPaths::CacheLocation);
-#else
-    QString cachePath = QDesktopServices::storageLocation(QDesktopServices::CacheLocation);
-#endif
     WebCore::makeAllDirectories(cachePath);
 
     QFileInfo info(cachePath);
diff --git a/Source/WebKit/qt/Api/qwebview.cpp b/Source/WebKit/qt/Api/qwebview.cpp
index a6082cf63..f90790f0c 100644
--- a/Source/WebKit/qt/Api/qwebview.cpp
+++ b/Source/WebKit/qt/Api/qwebview.cpp
@@ -34,10 +34,8 @@
 #include "qdir.h"
 #include "qfile.h"
 #ifndef QT_NO_ACCESSIBILITY
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include "qwebviewaccessible_p.h"
 #endif
-#endif
 
 class QWebViewPrivate {
 public:
@@ -154,7 +152,6 @@ void QWebViewPrivate::_q_pageDestroyed()
 */
 
 #ifndef QT_NO_ACCESSIBILITY
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 static QAccessibleInterface* accessibleInterfaceFactory(const QString& key, QObject* object)
 {
     Q_UNUSED(key)
@@ -168,7 +165,6 @@ static QAccessibleInterface* accessibleInterfaceFactory(const QString& key, QObj
     return 0;
 }
 #endif
-#endif
 
 /*!
     Constructs an empty QWebView with parent \a parent.
@@ -191,10 +187,8 @@ QWebView::QWebView(QWidget *parent)
     setFocusPolicy(Qt::WheelFocus);
 
 #ifndef QT_NO_ACCESSIBILITY
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
     QAccessible::installFactory(accessibleInterfaceFactory);
 #endif
-#endif
 }
 
 /*!
@@ -732,9 +726,7 @@ bool QWebView::event(QEvent *e)
         } else if (e->type() == QEvent::TouchBegin 
                    || e->type() == QEvent::TouchEnd 
                    || e->type() == QEvent::TouchUpdate
-#if HAVE(QT5)
                    || e->type() == QEvent::TouchCancel
-#endif
                   ) {
             d->page->event(e);
 
diff --git a/Source/WebKit/qt/Api/qwebview.h b/Source/WebKit/qt/Api/qwebview.h
index 90d0a8e3b..d4b4dd917 100644
--- a/Source/WebKit/qt/Api/qwebview.h
+++ b/Source/WebKit/qt/Api/qwebview.h
@@ -23,11 +23,7 @@
 
 #include "qwebkitglobal.h"
 #include "qwebpage.h"
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
 #include <QtWidgets/qwidget.h>
-#else
-#include <QtGui/qwidget.h>
-#endif
 #include <QtGui/qicon.h>
 #include <QtGui/qpainter.h>
 #include <QtCore/qurl.h>
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 3262f75a1..b008c205d 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,162 @@
+2012-08-11  Pierre Rossi  <pierre.rossi@gmail.com>
+
+        [Qt] Add support for HTML5 state object history API in FrameLoaderClientQt
+        https://bugs.webkit.org/show_bug.cgi?id=93648
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for push/replace/pop by implementing dispatchDidNavigateWithinPage.
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidNavigateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPushStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidReplaceStateWithinPage):
+        (WebCore::FrameLoaderClientQt::dispatchDidPopStateWithinPage):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+        (FrameLoaderClientQt):
+        * tests/qwebframe/tst_qwebframe.cpp:
+        (tst_QWebFrame):
+        (tst_QWebFrame::setUrlUsingStateObject): Added. Tests that the urlChanged signal is fired.
+
+2012-08-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove QRegExp <> JS RegExp conversion
+        https://bugs.webkit.org/show_bug.cgi?id=93716
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Removed tests that cover the automatic QRegExp <> JS RegExp conversion. See WebCore
+        ChangeLog for details.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (MyQObject::emitMySignalWithDateTimeArg):
+        (MyQObject):
+        (tst_QObjectBridge::overloadedSlots):
+        (tst_QObjectBridge::typeConversion):
+
+2012-08-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove support for __qt_sender__ in QObject bridge
+        https://bugs.webkit.org/show_bug.cgi?id=93649
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Support for __qt_sender__ has also been removed from QtScript/QJSEngine. The right
+        JavaScript solution to the problem is Function.prototype.bind.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::didClearWindowObject):
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate):
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::connectAndDisconnect):
+
+2012-08-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Port internal findMethodIndex method matcher to use JSC C API
+        https://bugs.webkit.org/show_bug.cgi?id=93463
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Adjust the expectations of the unit test for some of the exceptions the
+        method throws when signals/slots cannot be found/matched. The C API doesn't allow
+        us to create syntax (type) errors, only generic error exceptions.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::callQtInvokable):
+
+2012-08-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Add unit test for QObject bindings for scriptable plugins
+        https://bugs.webkit.org/show_bug.cgi?id=93462
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The bindings code is subject to refactoring in the future, so added a unit test to verify that
+        accessing an embedded QWidget from JavaScript goes through the QObject bindings.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge):
+        (TestPluginWidget):
+        (TestPluginWidget::TestPluginWidget):
+        (TestPluginWidget::slotWithReturnValue):
+        (TestWebPage):
+        (TestWebPage::TestWebPage):
+        (TestWebPage::createPlugin):
+        (tst_QObjectBridge::scriptablePlugin):
+
+2012-08-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial fix: Missed HAVE_QT5 removal as part of r124879
+
+        Fixes failing auto-test.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::enumerate_data):
+
+2012-08-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove Qt 4 specific code paths
+        https://bugs.webkit.org/show_bug.cgi?id=88161
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::sceneEvent):
+        * Api/qgraphicswebview.h:
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        * Api/qwebpage.cpp:
+        (QWebPage::event):
+        * Api/qwebpage.h:
+        * Api/qwebsettings.cpp:
+        (QWebSettings::enablePersistentStorage):
+        * Api/qwebview.cpp:
+        (QWebView::QWebView):
+        (QWebView::event):
+        * Api/qwebview.h:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::setToolTip):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+        * WebCoreSupport/GeolocationClientQt.cpp:
+        * WebCoreSupport/GeolocationClientQt.h:
+        * WebCoreSupport/PageClientQt.cpp:
+        (createPlatformGraphicsContext3DFromWidget):
+        (QWebPageClient::ownerWindow):
+        * WebCoreSupport/WebEventConversion.cpp:
+        (WebCore::WebKitPlatformTouchEvent::WebKitPlatformTouchEvent):
+        * declarative/declarative.pro:
+        * declarative/plugin.cpp:
+        * declarative/public.pri:
+        * examples/platformplugin/WebPlugin.cpp:
+        (WebPlugin::createExtension):
+        * examples/platformplugin/WebPlugin.h:
+        (WebPlugin):
+        * examples/platformplugin/platformplugin.pro:
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::arrayObjectEnumerable):
+        (tst_QObjectBridge::ownership):
+        (tst_QObjectBridge::qObjectWrapperWithSameIdentity):
+        * tests/tests.pri:
+        * tests/util.h:
+
+2012-08-01  Zeno Albisser  <zeno@webkit.org>
+
+        [Qt]REGRESSION(r123786): It made 3 fast/animation tests fail.
+        https://bugs.webkit.org/show_bug.cgi?id=92490
+
+        QAbstractAnimation:start() is implicitly calling updateTime
+        without going through the event loop. This resulted in executing
+        scripted animation callbacks right when registering a first callback.
+
+        Reviewed by Noam Rosenthal.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::RefreshAnimation::scheduleAnimation):
+            Invoke QAbstractAnimation::start() method through the event loop.
+
 2012-07-27  Csaba Osztrogonác  <ossy@webkit.org>
 
         [Qt][WK2] REGRESSION(r119127): resetting window.internals settings between tests doesn't work properly
diff --git a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 92814429b..912320ccd 100644
--- a/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -75,7 +75,6 @@
 #include <qeventloop.h>
 #include <qtooltip.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/qt/UtilsQt.h>
 
 #if ENABLE(VIDEO) && ((USE(GSTREAMER) && !defined(GST_API_VERSION_1)) || USE(QT_MULTIMEDIA) || USE(QTKIT))
 #include "FullScreenVideoQt.h"
@@ -104,7 +103,7 @@ public:
     {
         m_animationScheduled = true;
         if (state() != QAbstractAnimation::Running)
-            start();
+            QMetaObject::invokeMethod(this, "start", Qt::QueuedConnection);
     }
 
 protected:
@@ -549,7 +548,7 @@ void ChromeClientQt::setToolTip(const String &tip, TextDirection)
         view->setToolTip(QString());
         QToolTip::hideText();
     } else {
-        QString dtip = QLatin1String("<p>") + escapeHtml(tip) + QLatin1String("</p>");
+        QString dtip = QLatin1String("<p>") + QString(tip).toHtmlEscaped() + QLatin1String("</p>");
         view->setToolTip(dtip);
     }
 #else
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index a2c3cb210..bcd1a18ec 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -372,6 +372,20 @@ void FrameLoaderClientQt::dispatchWillPerformClientRedirect(const KURL& url, dou
     notImplemented();
 }
 
+void FrameLoaderClientQt::dispatchDidNavigateWithinPage()
+{
+    if (!m_webFrame)
+        return;
+
+    FrameLoader* loader = m_frame->loader();
+    bool loaderCompleted = !(loader->activeDocumentLoader() && loader->activeDocumentLoader()->isLoadingInAPISense());
+
+    if (!loaderCompleted)
+        return;
+
+    dispatchDidCommitLoad();
+    dispatchDidFinishLoad();
+}
 
 void FrameLoaderClientQt::dispatchDidChangeLocationWithinPage()
 {
@@ -391,7 +405,7 @@ void FrameLoaderClientQt::dispatchDidPushStateWithinPage()
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidPushStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    notImplemented();
+    dispatchDidNavigateWithinPage();
 }
 
 void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
@@ -399,7 +413,7 @@ void FrameLoaderClientQt::dispatchDidReplaceStateWithinPage()
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidReplaceStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    notImplemented();
+    dispatchDidNavigateWithinPage();
 }
 
 void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
@@ -407,7 +421,7 @@ void FrameLoaderClientQt::dispatchDidPopStateWithinPage()
     if (dumpFrameLoaderCallbacks)
         printf("%s - dispatchDidPopStateWithinPage\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    notImplemented();
+    // No need to call dispatchDidNavigateWithinPage here, it's already been done in loadInSameDocument().
 }
 
 void FrameLoaderClientQt::dispatchWillClose()
@@ -1604,22 +1618,13 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
         Vector<String> params = paramNames;
         Vector<String> values = paramValues;
         if (mimeType == "application/x-shockwave-flash") {
-#if HAVE(QT5)
-            const bool shouldInjectWmode = true;
-#else
             // Inject wmode=opaque when there is no client or the client is not a QWebView.
-            QWebPageClient* client = m_webFrame->page()->d->client.get();
-            const bool shouldInjectWmode = !(client && qobject_cast<QWidget*>(client->pluginParent()));
-#endif
-            if (shouldInjectWmode) {
-                // Inject wmode=opaque when there is no client or the client is not a QWebView.
-                size_t wmodeIndex = params.find("wmode");
-                if (wmodeIndex == WTF::notFound) {
-                    params.append("wmode");
-                    values.append("opaque");
-                } else if (equalIgnoringCase(values[wmodeIndex], "window"))
-                    values[wmodeIndex] = "opaque";
-            }
+            size_t wmodeIndex = params.find("wmode");
+            if (wmodeIndex == WTF::notFound) {
+                params.append("wmode");
+                values.append("opaque");
+            } else if (equalIgnoringCase(values[wmodeIndex], "window"))
+                values[wmodeIndex] = "opaque";
         }
 
         RefPtr<PluginView> pluginView = PluginView::create(m_frame, pluginSize, element, url,
diff --git a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index 781971d15..8d1c770c8 100644
--- a/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -108,6 +108,7 @@ public:
     virtual void dispatchDidReceiveServerRedirectForProvisionalLoad();
     virtual void dispatchDidCancelClientRedirect();
     virtual void dispatchWillPerformClientRedirect(const KURL&, double interval, double fireDate);
+    virtual void dispatchDidNavigateWithinPage() OVERRIDE;
     virtual void dispatchDidChangeLocationWithinPage();
     virtual void dispatchDidPushStateWithinPage();
     virtual void dispatchDidReplaceStateWithinPage();
diff --git a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
index 20ba353bd..b6b4d70bd 100644
--- a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.cpp
@@ -38,11 +38,7 @@
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 
-#if !HAVE(QT5)
-#include <QGeoPositionInfoSource>
-#elif HAVE(QT5)
 #include <QtLocation/QGeoPositionInfoSource>
-#endif
 
 namespace WebCore {
 
diff --git a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
index 726be157a..2e94bdebc 100644
--- a/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/GeolocationClientQt.h
@@ -31,18 +31,10 @@
 #include <QObject>
 #include <wtf/RefPtr.h>
 
-#if !HAVE(QT5)
-#include <QGeoPositionInfo>
-namespace QtMobility {
-class QGeoPositionInfoSource;
-};
-using namespace QtMobility;
-#elif HAVE(QT5)
 #include <QtLocation/QGeoPositionInfo>
 QT_BEGIN_NAMESPACE
 class QGeoPositionInfoSource;
 QT_END_NAMESPACE
-#endif
 
 
 class QWebPage;
diff --git a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
index 990179906..0093187af 100644
--- a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
@@ -33,9 +33,7 @@
 #endif
 
 #if USE(3D_GRAPHICS)
-#if HAVE(QT5)
 #include <QWindow>
-#endif
 
 static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformGraphicsContext3D* context,
                                                       PlatformGraphicsSurface3D* surface)
@@ -54,13 +52,8 @@ static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformG
     if (glWidget->isValid()) {
         // Geometry can be set to zero because m_glWidget is used only for its QGLContext.
         glWidget->setGeometry(0, 0, 0, 0);
-#if HAVE(QT5)
         *surface = glWidget->windowHandle();
         *context = glWidget->context()->contextHandle();
-#else
-        *surface = glWidget;
-        *context = const_cast<QGLContext*>(glWidget->context());
-#endif
     } else {
         delete glWidget;
         glWidget = 0;
@@ -74,7 +67,6 @@ static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformG
 #include "texmap/TextureMapperLayer.h"
 #endif
 
-#if HAVE(QT5)
 QWindow* QWebPageClient::ownerWindow() const
 {
     QWidget* widget = ownerWidget();
@@ -86,7 +78,6 @@ QWindow* QWebPageClient::ownerWindow() const
         return nativeParent->windowHandle();
     return 0;
 }
-#endif
 
 namespace WebCore {
 
diff --git a/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
index 0b732a4ce..222676620 100644
--- a/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/WebEventConversion.cpp
@@ -243,11 +243,9 @@ WebKitPlatformTouchEvent::WebKitPlatformTouchEvent(QTouchEvent* event)
     case QEvent::TouchEnd:
         m_type = PlatformEvent::TouchEnd;
         break;
-#if HAVE(QT5)
     case QEvent::TouchCancel:
         m_type = PlatformEvent::TouchCancel;
         break;
-#endif
     }
 
     const QList<QTouchEvent::TouchPoint>& points = event->touchPoints();
diff --git a/Source/WebKit/qt/declarative/declarative.pro b/Source/WebKit/qt/declarative/declarative.pro
index 737928338..04f2298d0 100644
--- a/Source/WebKit/qt/declarative/declarative.pro
+++ b/Source/WebKit/qt/declarative/declarative.pro
@@ -11,7 +11,7 @@ public_api.file = public.pri
 public_api.makefile = Makefile.declarative.public
 SUBDIRS += public_api
 
-haveQt(5):!no_webkit2 {
+!no_webkit2 {
     experimental_api.file = experimental/experimental.pri
     experimental_api.makefile = Makefile.declarative.experimental
     SUBDIRS += experimental_api
diff --git a/Source/WebKit/qt/declarative/plugin.cpp b/Source/WebKit/qt/declarative/plugin.cpp
index 1d44be23f..db748952a 100644
--- a/Source/WebKit/qt/declarative/plugin.cpp
+++ b/Source/WebKit/qt/declarative/plugin.cpp
@@ -25,13 +25,8 @@
 #include "qdeclarativewebview_p.h"
 #endif
 
-#if (HAVE(QT5))
 #include <QtQml/qqml.h>
 #include <QtQml/qqmlextensionplugin.h>
-#else
-#include <QtDeclarative/qdeclarative.h>
-#include <QtDeclarative/qdeclarativeextensionplugin.h>
-#endif
 
 #if defined(HAVE_WEBKIT2)
 #include "private/qquickwebpage_p.h"
@@ -46,12 +41,8 @@
 
 QT_BEGIN_NAMESPACE
 
-#if QT_VERSION >= 0x050000
 class WebKitQmlPlugin : public QQmlExtensionPlugin {
     Q_PLUGIN_METADATA(IID "org.qt-project.Qt.QQmlExtensionInterface" FILE "plugin.json")
-#else
-class WebKitQmlPlugin : public QDeclarativeExtensionPlugin {
-#endif
     Q_OBJECT
 public:
 #if defined(HAVE_WEBKIT2)
@@ -88,7 +79,3 @@ public:
 QT_END_NAMESPACE
 
 #include "plugin.moc"
-
-#if QT_VERSION < 0x050000
-Q_EXPORT_PLUGIN2(qmlwebkitplugin, QT_PREPEND_NAMESPACE(WebKitQmlPlugin));
-#endif
diff --git a/Source/WebKit/qt/declarative/public.pri b/Source/WebKit/qt/declarative/public.pri
index 34c66399f..e5c43db06 100644
--- a/Source/WebKit/qt/declarative/public.pri
+++ b/Source/WebKit/qt/declarative/public.pri
@@ -24,9 +24,7 @@ contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
 wince*:LIBS += $$QMAKE_LIBS_GUI
 
-QT += webkit webkit-private
-haveQt(4): QT += declarative
-haveQt(5): QT += widgets quick quick-private
+QT += webkit webkit-private widgets quick quick-private
 
 contains(DEFINES, HAVE_QQUICK1=1) {
     SOURCES += qdeclarativewebview.cpp
diff --git a/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp b/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
index fdd990f57..c71751177 100644
--- a/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
+++ b/Source/WebKit/qt/examples/platformplugin/WebPlugin.cpp
@@ -314,7 +314,3 @@ QObject* WebPlugin::createExtension(Extension extension) const
         return 0;
     }
 }
-
-#if QT_VERSION < QT_VERSION_CHECK(5, 0, 0)
-Q_EXPORT_PLUGIN2(platformplugin, WebPlugin)
-#endif
diff --git a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
index de06f4a84..446d0f754 100644
--- a/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
+++ b/Source/WebKit/qt/examples/platformplugin/WebPlugin.h
@@ -139,9 +139,7 @@ class WebPlugin : public QObject, public QWebKitPlatformPlugin
 {
     Q_OBJECT
     Q_INTERFACES(QWebKitPlatformPlugin)
-#if QT_VERSION >= 0x050000
     Q_PLUGIN_METADATA(IID "org.qt-project.QtWebKit.PlatformPluginInterface")
-#endif
 public:
     virtual bool supportsExtension(Extension extension) const;
     virtual QObject* createExtension(Extension extension) const;
diff --git a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
index b5da71ca0..fc533d3bb 100644
--- a/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
+++ b/Source/WebKit/qt/examples/platformplugin/platformplugin.pro
@@ -1,8 +1,7 @@
 TEMPLATE = lib
 TARGET = platformplugin
 
-QT += core gui
-haveQt(5): QT += widgets
+QT += core gui widgets
 CONFIG += plugin
 
 ## load mobilityconfig if mobility is available
diff --git a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
index 291f9b294..45626d9ef 100644
--- a/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
+++ b/Source/WebKit/qt/tests/qobjectbridge/tst_qobjectbridge.cpp
@@ -37,12 +37,6 @@ Q_DECLARE_METATYPE(Qt::BrushStyle)
 Q_DECLARE_METATYPE(QVariantList)
 Q_DECLARE_METATYPE(QVariantMap)
 
-#if QT_VERSION >= QT_VERSION_CHECK(5, 0, 0)
-#define OwnershipClass QWebFrame
-#else
-#define OwnershipClass QScriptEngine
-#endif
-
 class MyQObject : public QObject {
     Q_OBJECT
 
@@ -448,10 +442,6 @@ public:
     {
         emit mySignalWithDateTimeArg(dt);
     }
-    void emitMySignalWithRegexArg(QRegExp r)
-    {
-        emit mySignalWithRegexArg(r);
-    }
 
 public Q_SLOTS:
     void mySlot()
@@ -548,12 +538,6 @@ public Q_SLOTS:
         m_actuals << arg;
     }
 
-    void myOverloadedSlot(const QRegExp &arg)
-    {
-        m_qtFunctionInvoked = 34;
-        m_actuals << arg;
-    }
-
     void myOverloadedSlot(const QVariant &arg)
     {
         m_qtFunctionInvoked = 35;
@@ -581,7 +565,6 @@ Q_SIGNALS:
     void mySignalWithDoubleArg(double);
     void mySignal2(bool arg = false);
     void mySignalWithDateTimeArg(QDateTime);
-    void mySignalWithRegexArg(QRegExp);
 
 private:
     int m_intValue;
@@ -658,6 +641,7 @@ private slots:
     void qObjectWrapperWithSameIdentity();
     void introspectQtMethods_data();
     void introspectQtMethods();
+    void scriptablePlugin();
 
 private:
     QString evalJS(const QString& s)
@@ -1147,7 +1131,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithVoidStarArg(123)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: incompatible type of argument(s) in call to myInvokableWithVoidStarArg(); candidates were\n    myInvokableWithVoidStarArg(void*)"));
+        QCOMPARE(ret, QLatin1String("Error: incompatible type of argument(s) in call to myInvokableWithVoidStarArg(); candidates were\n    myInvokableWithVoidStarArg(void*)"));
         QCOMPARE(m_myObject->qtFunctionInvoked(), -1);
     }
 
@@ -1156,7 +1140,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithAmbiguousArg(123)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: ambiguous call of overloaded function myInvokableWithAmbiguousArg(); candidates were\n    myInvokableWithAmbiguousArg(int)\n    myInvokableWithAmbiguousArg(uint)"));
+        QCOMPARE(ret, QLatin1String("Error: ambiguous call of overloaded function myInvokableWithAmbiguousArg(); candidates were\n    myInvokableWithAmbiguousArg(int)\n    myInvokableWithAmbiguousArg(uint)"));
     }
 
     m_myObject->resetQtFunctionInvoked();
@@ -1385,7 +1369,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithIntArg()", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("SyntaxError: too few arguments in call to myInvokableWithIntArg(); candidates are\n    myInvokableWithIntArg(int,int)\n    myInvokableWithIntArg(int)"));
+        QCOMPARE(ret, QLatin1String("Error: too few arguments in call to myInvokableWithIntArg(); candidates are\n    myInvokableWithIntArg(int,int)\n    myInvokableWithIntArg(int)"));
     }
 
     // call function where not all types have been registered
@@ -1394,7 +1378,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithBrushStyleArg(0)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: cannot call myInvokableWithBrushStyleArg(): unknown type `Qt::BrushStyle'"));
+        QCOMPARE(ret, QLatin1String("Error: cannot call myInvokableWithBrushStyleArg(): unknown type `Qt::BrushStyle'"));
         QCOMPARE(m_myObject->qtFunctionInvoked(), -1);
     }
 
@@ -1404,7 +1388,7 @@ void tst_QObjectBridge::callQtInvokable()
         QString type;
         QString ret = evalJS("myObject.myInvokableWithQBrushArg(null)", type);
         QCOMPARE(type, sError);
-        QCOMPARE(ret, QLatin1String("TypeError: incompatible type of argument(s) in call to myInvokableWithQBrushArg(); candidates were\n    myInvokableWithQBrushArg(QBrush)"));
+        QCOMPARE(ret, QLatin1String("Error: incompatible type of argument(s) in call to myInvokableWithQBrushArg(); candidates were\n    myInvokableWithQBrushArg(QBrush)"));
         QCOMPARE(m_myObject->qtFunctionInvoked(), -1);
     }
 }
@@ -1422,7 +1406,7 @@ void tst_QObjectBridge::connectAndDisconnect()
         QCOMPARE(type, sError);
     }
 
-    evalJS("myHandler = function() { window.gotSignal = true; window.signalArgs = arguments; window.slotThisObject = this; window.signalSender = __qt_sender__; }");
+    evalJS("myHandler = function() { window.gotSignal = true; window.signalArgs = arguments; window.slotThisObject = this; }");
 
     QCOMPARE(evalJS("myObject.mySignal.connect(myHandler)"), sUndefined);
 
@@ -1430,7 +1414,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     evalJS("myObject.mySignal()");
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 0"), sTrue);
-    QCOMPARE(evalJS("signalSender"), evalJS("myObject"));
     QCOMPARE(evalJS("slotThisObject == window"), sTrue);
 
     evalJS("gotSignal = false");
@@ -1494,7 +1477,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 0"), sTrue);
     QCOMPARE(evalJS("slotThisObject"), evalJS("otherObject"));
-    QCOMPARE(evalJS("signalSender"), evalJS("myObject"));
     QCOMPARE(evalJS("slotThisObject.name"), QLatin1String("foo"));
     QCOMPARE(evalJS("myObject.mySignal.disconnect(otherObject, myHandler)"), sUndefined);
 
@@ -1505,7 +1487,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 1"), sTrue);
     QCOMPARE(evalJS("slotThisObject == yetAnotherObject"), sTrue);
-    QCOMPARE(evalJS("signalSender == myObject"), sTrue);
     QCOMPARE(evalJS("slotThisObject.name"), QLatin1String("bar"));
     QCOMPARE(evalJS("myObject.mySignal2.disconnect(yetAnotherObject, myHandler)"), sUndefined);
 
@@ -1515,7 +1496,6 @@ void tst_QObjectBridge::connectAndDisconnect()
     QCOMPARE(evalJS("gotSignal"), sTrue);
     QCOMPARE(evalJS("signalArgs.length == 1"), sTrue);
     QCOMPARE(evalJS("slotThisObject == myObject"), sTrue);
-    QCOMPARE(evalJS("signalSender == myObject"), sTrue);
     QCOMPARE(evalJS("myObject.mySignal2.disconnect(myObject, myHandler)"), sUndefined);
 
     // connect(obj, string)
@@ -1756,11 +1736,6 @@ void tst_QObjectBridge::overloadedSlots()
     evalJS("myObject.myOverloadedSlot(new Date())");
     QCOMPARE(m_myObject->qtFunctionInvoked(), 32);
 
-    // should pick myOverloadedSlot(QRegExp)
-    m_myObject->resetQtFunctionInvoked();
-    evalJS("myObject.myOverloadedSlot(new RegExp())");
-    QCOMPARE(m_myObject->qtFunctionInvoked(), 34);
-
     // should pick myOverloadedSlot(QVariant)
     /* XFAIL
     m_myObject->resetQtFunctionInvoked();
@@ -1831,9 +1806,7 @@ void tst_QObjectBridge::enumerate_data()
         << "dp1" << "dp2" << "dp3"
         // inherited signals and slots
         << "destroyed(QObject*)" << "destroyed()"
-#if defined(HAVE_QT5) && HAVE_QT5
         << "objectNameChanged(QString)"
-#endif
         << "deleteLater()"
         // not included because it's private:
         // << "_q_reregisterTimers(void*)"
@@ -1982,8 +1955,6 @@ void tst_QObjectBridge::typeConversion()
     QCOMPARE(evalJS("window.__date_equals"), sTrue);
     evalJS("delete window.__date_equals");
     evalJS("myObject.mySignalWithDateTimeArg.disconnect(checkDate); delete checkDate;");
-
-    // ### RegExps
 }
 
 class StringListTestObject : public QObject {
@@ -2000,7 +1971,7 @@ void tst_QObjectBridge::arrayObjectEnumerable()
     QWebPage page;
     QWebFrame* frame = page.mainFrame();
     QObject* qobject = new StringListTestObject();
-    frame->addToJavaScriptWindowObject("test", qobject, OwnershipClass::ScriptOwnership);
+    frame->addToJavaScriptWindowObject("test", qobject, QWebFrame::ScriptOwnership);
 
     const QString script("var stringArray = test.stringList();"
                          "var result = '';"
@@ -2041,7 +2012,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", ptr.data(), OwnershipClass::ScriptOwnership);
+            frame->addToJavaScriptWindowObject("test", ptr.data(), QWebFrame::ScriptOwnership);
         }
         QVERIFY(!ptr);
     }
@@ -2052,7 +2023,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", ptr.data(), OwnershipClass::QtOwnership);
+            frame->addToJavaScriptWindowObject("test", ptr.data(), QWebFrame::QtOwnership);
         }
         QVERIFY(ptr.data() == before);
         delete ptr.data();
@@ -2062,7 +2033,7 @@ void tst_QObjectBridge::ownership()
         QObject* child = new QObject(parent);
         QWebPage page;
         QWebFrame* frame = page.mainFrame();
-        frame->addToJavaScriptWindowObject("test", child, OwnershipClass::QtOwnership);
+        frame->addToJavaScriptWindowObject("test", child, QWebFrame::QtOwnership);
         QVariant v = frame->evaluateJavaScript("test");
         QCOMPARE(qvariant_cast<QObject*>(v), child);
         delete parent;
@@ -2075,7 +2046,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", ptr.data(), OwnershipClass::AutoOwnership);
+            frame->addToJavaScriptWindowObject("test", ptr.data(), QWebFrame::AutoOwnership);
         }
         // no parent, so it should be like ScriptOwnership
         QVERIFY(!ptr);
@@ -2087,7 +2058,7 @@ void tst_QObjectBridge::ownership()
         {
             QWebPage page;
             QWebFrame* frame = page.mainFrame();
-            frame->addToJavaScriptWindowObject("test", child.data(), OwnershipClass::AutoOwnership);
+            frame->addToJavaScriptWindowObject("test", child.data(), QWebFrame::AutoOwnership);
         }
         // has parent, so it should be like QtOwnership
         QVERIFY(child);
@@ -2129,7 +2100,7 @@ void tst_QObjectBridge::qObjectWrapperWithSameIdentity()
     QWebFrame* mainFrame = m_view->page()->mainFrame();
     QCOMPARE(mainFrame->toPlainText(), QString("test"));
 
-    mainFrame->addToJavaScriptWindowObject("test", new TestFactory, OwnershipClass::ScriptOwnership);
+    mainFrame->addToJavaScriptWindowObject("test", new TestFactory, QWebFrame::ScriptOwnership);
 
     mainFrame->evaluateJavaScript("triggerBug();");
     QCOMPARE(mainFrame->toPlainText(), QString("test1"));
@@ -2189,5 +2160,47 @@ void tst_QObjectBridge::webElementSlotOnly()
     QCOMPARE(evalJS("myWebElementSlotObject.tagName"), QString("BODY"));
 }
 
+class TestPluginWidget : public QWidget {
+    Q_OBJECT
+public:
+    TestPluginWidget() { }
+
+public slots:
+    int slotWithReturnValue() { return 42; }
+};
+
+class TestWebPage : public QWebPage {
+    Q_OBJECT
+public:
+    TestWebPage(QObject* parent = 0)
+        : QWebPage(parent)
+        , creationCount(0)
+    { }
+
+    int creationCount;
+
+protected:
+    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&)
+    {
+        creationCount++;
+        return new TestPluginWidget;
+    }
+};
+
+void tst_QObjectBridge::scriptablePlugin()
+{
+    QWebView view;
+    TestWebPage* page = new TestWebPage;
+    view.setPage(page);
+    page->setParent(&view);
+    view.settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+
+    page->mainFrame()->setHtml("<object width=100 height=100 type=\"application/x-qt-plugin\"></object>");
+    QCOMPARE(page->creationCount, 1);
+
+    QVariant result = page->mainFrame()->evaluateJavaScript("document.querySelector(\"object\").slotWithReturnValue()");
+    QCOMPARE(result.toString(), QLatin1String("42"));
+}
+
 QTEST_MAIN(tst_QObjectBridge)
 #include "tst_qobjectbridge.moc"
diff --git a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 31d87b75a..d7db84726 100644
--- a/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/Source/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -90,6 +90,7 @@ private slots:
     void setUrlToEmpty();
     void setUrlToInvalid();
     void setUrlHistory();
+    void setUrlUsingStateObject();
     void setUrlSameUrl();
     void setUrlThenLoads_data();
     void setUrlThenLoads();
@@ -1309,6 +1310,48 @@ void tst_QWebFrame::setUrlHistory()
     QCOMPARE(m_page->history()->count(), 2);
 }
 
+void tst_QWebFrame::setUrlUsingStateObject()
+{
+    const QUrl aboutBlank("about:blank");
+    QUrl url;
+    QWebFrame* frame = m_page->mainFrame();
+    QSignalSpy urlChangedSpy(frame, SIGNAL(urlChanged(QUrl)));
+    int expectedUrlChangeCount = 0;
+
+    QCOMPARE(m_page->history()->count(), 0);
+
+    url = QUrl("qrc:/test1.html");
+    frame->setUrl(url);
+    waitForSignal(m_page, SIGNAL(loadFinished(bool)));
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), url);
+    QCOMPARE(m_page->history()->count(), 1);
+
+    frame->evaluateJavaScript("window.history.pushState(null,'push', 'navigate/to/here')");
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), QUrl("qrc:/navigate/to/here"));
+    QCOMPARE(m_page->history()->count(), 2);
+    QVERIFY(m_page->history()->canGoBack());
+
+    frame->evaluateJavaScript("window.history.replaceState(null,'replace', 'another/location')");
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), QUrl("qrc:/navigate/to/another/location"));
+    QCOMPARE(m_page->history()->count(), 2);
+    QVERIFY(!m_page->history()->canGoForward());
+    QVERIFY(m_page->history()->canGoBack());
+
+    frame->evaluateJavaScript("window.history.back()");
+    QTest::qWait(100);
+    expectedUrlChangeCount++;
+    QCOMPARE(urlChangedSpy.count(), expectedUrlChangeCount);
+    QCOMPARE(frame->url(), QUrl("qrc:/test1.html"));
+    QVERIFY(m_page->history()->canGoForward());
+    QVERIFY(!m_page->history()->canGoBack());
+}
+
 void tst_QWebFrame::setUrlSameUrl()
 {
     const QUrl url1("qrc:/test1.html");
diff --git a/Source/WebKit/qt/tests/tests.pri b/Source/WebKit/qt/tests/tests.pri
index 90c61f093..5437baacc 100644
--- a/Source/WebKit/qt/tests/tests.pri
+++ b/Source/WebKit/qt/tests/tests.pri
@@ -16,10 +16,7 @@ INCLUDEPATH += \
     $$PWD \
     $$PWD/../Api
 
-QT += testlib network webkit
-haveQt(5): QT += widgets
-
-haveQt(4): haveQtModule(declarative): QT += declarative
+QT += testlib network webkit widgets
 
 # This define is used by some tests to look up resources in the source tree
 DEFINES += TESTS_SOURCE_DIR=\\\"$$PWD/\\\"
diff --git a/Source/WebKit/qt/tests/util.h b/Source/WebKit/qt/tests/util.h
index cfa22eb08..2869440cb 100644
--- a/Source/WebKit/qt/tests/util.h
+++ b/Source/WebKit/qt/tests/util.h
@@ -53,37 +53,4 @@ static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
     return timeoutSpy.isEmpty();
 }
 
-#if !(defined(HAVE_QT5) && HAVE_QT5)
-// Will try to wait for the condition while allowing event processing
-#define QTRY_VERIFY(__expr) \
-    do { \
-        const int __step = 50; \
-        const int __timeout = 5000; \
-        if (!(__expr)) { \
-            QTest::qWait(0); \
-        } \
-        for (int __i = 0; __i < __timeout && !(__expr); __i+=__step) { \
-            QTest::qWait(__step); \
-        } \
-        QVERIFY(__expr); \
-    } while(0)
-
-// Will try to wait for the condition while allowing event processing
-#define QTRY_COMPARE(__expr, __expected) \
-    do { \
-        const int __step = 50; \
-        const int __timeout = 5000; \
-        if ((__expr) != (__expected)) { \
-            QTest::qWait(0); \
-        } \
-        for (int __i = 0; __i < __timeout && ((__expr) != (__expected)); __i+=__step) { \
-            QTest::qWait(__step); \
-        } \
-        QCOMPARE(__expr, __expected); \
-    } while(0)
-
-// Compatibility for Qt5
-#define W_QSKIP(a, b) QSKIP(a, b)
-#else
 #define W_QSKIP(a, b) QSKIP(a)
-#endif
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 86942ca6a..d13a3fc1c 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,18 @@
+2012-08-05  Patrick Gansterer  <paroga@webkit.org>
+
+        [WIN] Use sizeof() for cbWndExtra values
+        https://bugs.webkit.org/show_bug.cgi?id=93179
+
+        Reviewed by Eric Carlson.
+
+        Using sizof() instead of hardcoding the pointer size of
+        the 32bit platform allows us to use the code on 64bit too.
+
+        * FullscreenVideoController.cpp:
+        (FullscreenVideoController::registerHUDWindowClass):
+        * WebView.cpp:
+        (WebView::registerWebViewWindowClass):
+
 2012-07-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
 
         [Mac] Fix build break on Apple win bot after r123711
diff --git a/Source/WebKit/win/FullscreenVideoController.cpp b/Source/WebKit/win/FullscreenVideoController.cpp
index 203e229e3..f9dd6fcd3 100644
--- a/Source/WebKit/win/FullscreenVideoController.cpp
+++ b/Source/WebKit/win/FullscreenVideoController.cpp
@@ -422,7 +422,7 @@ void FullscreenVideoController::registerHUDWindowClass()
     wcex.style = CS_HREDRAW | CS_VREDRAW;
     wcex.lpfnWndProc = hudWndProc;
     wcex.cbClsExtra = 0;
-    wcex.cbWndExtra = 4;
+    wcex.cbWndExtra = sizeof(FullscreenVideoController*);
     wcex.hInstance = gInstance;
     wcex.hIcon = 0;
     wcex.hCursor = LoadCursor(0, IDC_ARROW);
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index ececdff22..70d491edb 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -2105,7 +2105,7 @@ bool WebView::registerWebViewWindowClass()
     wcex.style          = CS_DBLCLKS;
     wcex.lpfnWndProc    = WebViewWndProc;
     wcex.cbClsExtra     = 0;
-    wcex.cbWndExtra     = 4; // 4 bytes for the IWebView pointer
+    wcex.cbWndExtra     = sizeof(WebView*);
     wcex.hInstance      = gInstance;
     wcex.hIcon          = 0;
     wcex.hCursor        = ::LoadCursor(0, IDC_ARROW);